Artifact app and published-link access

Choose public or signed-in viewer access without granting draft collaboration.

Where to find it

Open Apps & Workspaces, choose the workspace, and open the artifact. Its header and drawers contain the settings for this guide.

Address: /artifacts/:id, /p/:token. Open the saved resource from the product rather than typing this address.

Choose the audience

Intended audience	Where to configure it	What the recipient gets
Anyone who receives the app link	App access > Who can use it, set Live app access to Anyone with the link	The live app without signing in
Specific people, including people outside your Topline company	App access > Add app users	The live app after signing in with an approved email
Teammates who need to review or work on the artifact inside Topline	Topline access > Add people with the Viewer or Editor role, or workspace Sharing & access	Authenticated artifact access, including drafts and version history; editing only with Editor access

Sharing uses two drawers, opened from buttons on the right of the artifact page header. Topline access controls who can view or edit the artifact inside Topline. App access controls who can use the live app and holds the app's publishing controls; for documents, reports, and other non-app artifacts the same drawer is called Link access and controls the published link. App addresses are managed in a third drawer, App addresses.

For a finished app shared with a few customers or partners, use the second row. Use the third row when the person should also review drafts or collaborate. Workspace sharing covers contained artifacts, so use a direct artifact grant when they should receive only one item.

Make the live app public

1. Publish a reviewed version live using the publishing guide.
2. Open App access and, under Who can use it, set Live app access to Anyone with the link.
3. Review the confirmation and select Confirm anyone with the link.
4. Confirm Live app access reads Anyone with the link. Open the main address shown at the top of the drawer (it opens in a new tab), or use Copy app link.
5. Test that link in a separate signed-out browser session. It should open the live version without asking for sign-in.

Anyone who receives or forwards this link can use it. Review the app's pages, downloads, and exposed data before enabling public access. A hard-to-guess URL is not an access restriction.

Allow specific signed-in app users

This is the shortest path for a person who should use the finished app without getting access to Topline drafts or editing.

1. Publish the reviewed app live, then open App access. Before the app is live, the drawer says "Publish a live version before sharing the live app. The draft stays private."
2. In Add app users, enter the person's complete email address and select Add.
3. Repeat for each intended viewer. Use the actual address they will sign in with, such as viewer@example.com; this control accepts individual email addresses, not a company-domain rule.
4. Confirm Live app access reads Only people added and each person is listed under Add app users.
5. Use Copy app link and send the link to the recipients yourself. Saving access does not send an invitation or notification email.
6. Have a recipient open the link and complete the sign-in flow offered by Topline using the approved email. External viewer sign-in requires a verified email and returns the person to the live app.
7. Test both an approved viewer and an unrelated account in separate browser sessions. The unrelated account must have neither a viewer grant nor existing Topline collaboration access.

Adding an app user to an Anyone with the link app switches it to Only people added and requires sign-in. A viewer grant does not enroll that person as a Topline company member or grant workspace, draft, version-history, editing, publishing, or scheduling access. The available sign-in methods depend on the account's identity setup; the approved email still determines access.

Existing owners and authorized Topline collaborators keep their independent artifact access. A live-app allowlist does not revoke those grants. Test external access with an account that is not already a collaborator.

Verify and revoke access

A hosted app shows its main address as a chip under the artifact title. Select it, or See all N addresses / Manage addresses in App access, to open App addresses. Every listed address opens the same live version and follows App access. To change the Topline address, select Edit, enter an optional Site name and a Page name, review the preview, and select Save address. Use Add address for another Topline site name or a Company website. Address links open in a new tab, and each row has a copy button. Claiming an address does not deploy or publish a draft and does not change who can use the app.

Published artifact apps can use a clean address on any company domain connected under Account > Domains. The workspace default is only the initial choice; an artifact owner can choose another connected domain and path. Select Remove on the Company website row in App addresses to move the app back to its Topline address, and move every artifact off a domain before removing the domain itself. Protected viewers still sign in through Topline and return to the customer URL. See Company domains for artifact apps.

To revoke a specific external viewer, select Remove access beside their email under Add app users in App access. Removing the last app user turns off live app access; it does not make the app public. Setting Live app access to Off and confirming Turn off live app access disables the outside link for everyone while preserving Topline collaboration grants and the deployed live version. Revoking internal access requires removing the applicable direct, workspace, company-wide, or scope grants separately.

After a content update, deploy and validate the new draft, publish that reviewed version live, and recheck the existing saved link and audience. Changing the address or viewer list alone does not publish the content update.

For documents, reports, and other non-app artifacts, open Link access. Set Published link access, add specific people under Add link viewers, or choose Anyone with the link for public delivery. Custom URL and embed holds the custom /s/ URL and embed code, and Copy link copies the published link. These links open the published read-only viewer; add people as Viewer in Topline access for draft review.

Never use public access for tenant-private data, credentials, raw PII, or an unreviewed draft.

Troubleshoot

• Not live / publish a live version first: a deployed draft or a claimed app address is insufficient. Return to the artifact, open App access > Publishing, resolve the blockers listed under Publishing details, and publish the reviewed version live.
• Sharing controls unavailable: confirm you are the artifact owner. Editor access alone does not grant owner-only sharing controls; other people see a read-only Topline access view.
• Viewer received no invitation: access changes send no email. Copy the saved app link and send it yourself.
• Sign-in succeeds but the viewer is denied: check the exact approved email, including aliases, and complete email verification when requested. Reopen the saved app link using that identity. For internal access, confirm current company membership and the artifact or workspace grant.
• The owner can open it, but the recipient cannot: the owner has independent collaboration access. Test the recipient's link and account in a separate browser session.
• Everyone can still open it: confirm Live app access reads Only people added, rather than Anyone with the link. Reload after a failed save and test a signed-out session and an unrelated account.
• A removed person still has access: check their remaining direct, workspace, company-wide, and scope grants. Removing one grant does not remove the others.
• The link shows an older app: check the live version; a newer draft is not visible through the live link until published.
• Custom URL fails: use the saved Topline address to isolate an address issue. A company domain must show Connected before its URL is ready. Follow the domain troubleshooting guide.

Related guides

• Publishing
• Topline collaboration access
• Addresses and embeds