# Sharing and Access Links

Share human-readable viewers and machine-readable manifests without exposing API Keys.

Human page: /docs/sharing
Markdown page: /docs/sharing.md

## Link types

| Link | Use |
| --- | --- |
| Private Link | Authenticated dashboard viewer for Workspace members. |
| Share Link | Access Link for the latest Published Revision of an Artifact. |
| Revision Link | Access Link pinned to one specific Revision. |
| Artifact URL | App-origin live viewer for the latest Published Revision of an Artifact. |
| Share URL | Public access-bearing URL for an Artifact viewer. |
| Revision Content URL | Direct signed `usercontent.agent-paste.sh/v/...` content URL for one specific Revision. |
| Agent View URL | JSON manifest for agents, either authenticated or public through a signed token. |

## Signed URL shape

Access Link URLs are shaped like `https://app.agent-paste.sh/al/{publicId}#{blob}`. The signature payload lives in the URL fragment so it is not sent to servers in normal HTTP requests.

The `publicId` identifies the link row. The fragment is the credential. Re-minting creates a fresh signed URL with a fresh expiration.

Use Artifact URLs for stable human handoff. Use Share URLs when the same viewer needs public access. Use Revision Links or Revision Content URLs only when the reader must see one exact Revision.

## Create, mint, revoke, lockdown

Use the dashboard Access Links page or Artifact detail page to create links, reveal freshly minted signed URLs, revoke links, or engage Access Link Lockdown for an Artifact.

MCP can create Share Links and Revision Links, list links, and revoke links for authenticated members. The CLI focuses on publish and does not manage Access Links directly.

> Revocation boundary
> Revoking an Access Link stops future resolves and deny-lists already minted content URLs for that link. Deleting an Artifact is separate and makes the Artifact inaccessible.

## Recipients

A human opens the Access Link in a browser. An agent should prefer Agent View when it needs file trees, metadata, or signed per-file URLs.