---
title: "Sharing — choose the audience and revoke access"
description: "Compare member access, public document and AI context links, HTML shares, and media references; understand live reads, expiry, and revocation."
---

# Sharing — choose the audience and revoke access

Choose what a recipient should be able to read before copying a link. A normal Project URL requires membership. A public share URL grants read access to anyone who possesses it, including an external AI service you paste it into. It does not grant membership or permission to edit or run agents.

## Choose a sharing method

| Need | Method and audience | Who manages it / lifetime |
|---|---|---|
| Work together inside the Project | Normal Project/document links; authenticated members and their roles | Manage membership in [Projects](/en/docs/projects); a copied URL does not add a member |
| Let an outsider read one deliverable | Public document Markdown link, including supported media referenced by that document | Collaborator/Admin create; creator manages their own document links, Admin all links; UI expiry 7 days |
| Give an external reader broad Project context | Public AI context Markdown link, Project timeline, documents, and Project session transcripts | Admin only; UI expiry 7 days |
| Show an interactive static report | [Share HTML](/en/docs/html), Project HTML snapshot and its media dependencies | Human Collaborator/Admin; default 7 days, maximum 30, optional password, reset or stop |
| Reference an image, video, or PDF internally | [Media canonical URL](/en/docs/media), `/m/<uuid>` | Authenticated membership in the owning active Project; it is not a public sharing token |
| Invite someone to participate | Project join link | Membership/invitation rules apply; see [Projects](/en/docs/projects), not the public read-only share rules |
| Reuse a Project structure or a client entry | Template or connected-repository entry | A separate reuse/start-work flow; see [Connected repo](/en/docs/connected-repo) |

Publishing a Media asset to a Project does not by itself publish it anonymously. A Markdown or HTML share can expose its authorized media dependencies through that share's delivery path. Review images, PDFs, and video as well as text before sharing.

## Share one document

1. In an active ordinary Project where you are Collaborator or Admin, open the saved document in **Docs**. Check the entire current body, frontmatter, and referenced media.
2. Select **Create public document link** (the globe button). Confirm **Create and copy public link**.
3. Paste the copied URL into the intended reader or external AI tool. The URL has the form shown below; use the returned URL as-is rather than constructing it.
4. Open the link in a signed-out browser to check the recipient's view. It returns read-only Markdown, not the full document editor. WikiLinks and structured blocks do not grant access to other documents or execute work.

```text
https://aachat.work/share/<token>/docs/<kind>/<id>.md
```

A document share is bound to that document, not to every document linked from it. It cannot read Project context or session transcripts. Supported references to ready Project Media in its current content can be delivered through the share. Removing a current media reference removes that dependency's authorization through this share.

## Share Project context with an external AI

An Admin can use **Create public AI context link** in the Project header, review the warning, and select **Create and copy public link**. The returned URL ends in `/context.md`. Read it and follow its document, session, and pagination links before deciding that its scope is appropriate.

**This is broad Project read access, not a hand-picked set of documents.** The context surface contains Project timeline records and a document catalog, and the token permits reading documents and session transcripts in that Project. Older records are available through pagination. Do not assume that only links visible on the first page define the token's authority. Referenced ready media may also be exposed. A single-document share is the narrower choice for a finished report.

Both Markdown share types perform a **live read**. Later edits are visible through an existing token, and a context token can reach later Project records. The link is not a frozen export of what you reviewed at creation. Keep future confidential work outside a shared scope, or revoke the link before adding it.

## Expiry, listing, and revocation

The WebUI creates Markdown shares for **7 days** and has no expiry picker. The create API accepts `expires_in_days` from **1 to 30**, default 7; this does not imply an expiry editor or renewal button in the UI. Markdown shares do not have the HTML share's password/reset/extend controls.

Open **Project Settings → Public shares** to inspect active links by scope and expiry. Collaborators can see and revoke only document shares they created. Admins can see and revoke all active document and context shares. Viewers cannot create or manage them. Select **Revoke**, then confirm; the URL stops authorizing subsequent reads.

Existing URLs cannot be copied again from the list because raw tokens are not stored. If the URL is lost or clipboard copying fails after creation, inspect the active list, revoke the unwanted link, and create a new one. Repeated creation produces separate links; it does not replace the old token.

A revoked or expired token, or a Project that is no longer active, cannot be used to read the share. Revocation cannot retrieve a recipient's downloaded copy or remove content already sent to another service.

## If sharing fails

- A missing or disabled action: check that you are in an active ordinary Project and have the required role. Use a document share as Collaborator; context creation requires Admin.
- A reader sees not found: check expiry and revocation in Public shares, Project status, whether the document still exists, and whether the URL is exact. A document token cannot be repurposed for context, another document, or a session URL.
- A media reference fails: check that the current shared content still references a ready asset. Do not paste a short-lived signed storage URL as a workaround.
- The audience needs to edit or operate agents: use Project membership. Public read-only shares cannot provide those permissions.

For where data is stored and where HTML JavaScript executes, see [Trust boundary](/en/docs/trust-boundary).