# Artifact app and published-link access

Choose public or signed-in viewer access without granting draft collaboration.

## Where to find it

Open **Apps & Workspaces**, choose the workspace, and open the artifact. Its header and drawers contain the settings for this guide.

Address: `/artifacts/:id`, `/p/:token`. Open the saved resource from the product rather than typing this address.

## Choose the audience

| Intended audience | Where to configure it | What the recipient gets |
| --- | --- | --- |
| Anyone who receives the app link | **App access > Who can use it**, set **Live app access** to **Anyone with the link** | The live app without signing in |
| Specific people, including people outside your Topline company | **App access > Add app users** | The live app after signing in with an approved email |
| Teammates who need to review or work on the artifact inside Topline | **Topline access > Add people** with the **Viewer** or **Editor** role, or workspace **Sharing & access** | Authenticated artifact access, including drafts and version history; editing only with Editor access |

Sharing uses two drawers, opened from buttons on the right of the artifact
page header. **Topline access** controls who can view or edit the artifact
inside Topline. **App access** controls who can use the live app and holds
the app's publishing controls; for documents, reports, and other non-app
artifacts the same drawer is called **Link access** and controls the published
link. App addresses are managed in a third drawer, **App addresses**.

For a finished app shared with a few customers or partners, use the second
row. Use the third row when the person should also review drafts or collaborate.
Workspace sharing covers contained artifacts, so use a direct artifact grant
when they should receive only one item.

## Make the live app public

1. Publish a reviewed version live using the [publishing guide](/docs/artifact-publishing).
2. Open **App access** and, under **Who can use it**, set **Live app access**
   to **Anyone with the link**.
3. Review the confirmation and select **Confirm anyone with the link**.
4. Confirm **Live app access** reads **Anyone with the link**. Open the main
   address shown at the top of the drawer (it opens in a new tab), or use
   **Copy app link**.
5. Test that link in a separate signed-out browser session. It should open the
   live version without asking for sign-in.

Anyone who receives or forwards this link can use it. Review the app's pages,
downloads, and exposed data before enabling public access. A hard-to-guess URL
is not an access restriction.

## Allow specific signed-in app users

This is the shortest path for a person who should use the finished app without
getting access to Topline drafts or editing.

1. Publish the reviewed app live, then open **App access**. Before the app is
   live, the drawer says "Publish a live version before sharing the live app.
   The draft stays private."
2. In **Add app users**, enter the person's complete email address and select
   **Add**.
3. Repeat for each intended viewer. Use the actual address they will sign in
   with, such as `viewer@example.com`; this control accepts individual email
   addresses, not a company-domain rule.
4. Confirm **Live app access** reads **Only people added** and each person is
   listed under **Add app users**.
5. Use **Copy app link** and send the link to the recipients
   yourself. Saving access does **not** send an invitation or notification email.
6. Have a recipient open the link and complete the sign-in flow offered by
   Topline using the approved email. External viewer sign-in requires a verified
   email and returns the person to the live app.
7. Test both an approved viewer and an unrelated account in separate browser
   sessions. The unrelated account must have neither a viewer grant nor existing
   Topline collaboration access.

Adding an app user to an **Anyone with the link** app switches it to
**Only people added** and requires sign-in. A viewer grant does not enroll that
person as a Topline company member or grant workspace, draft, version-history,
editing, publishing, or scheduling access. The available sign-in methods depend
on the account's identity setup; the approved email still determines access.

Existing owners and authorized Topline collaborators keep their independent
artifact access. A live-app allowlist does not revoke those grants. Test external
access with an account that is not already a collaborator.

## Verify and revoke access

A hosted app shows its main address as a chip under the artifact title.
Select it, or **See all N addresses** / **Manage addresses** in **App access**,
to open **App addresses**. Every listed address opens the same live version and
follows **App access**. To change the **Topline address**, select **Edit**,
enter an optional **Site name** and a **Page name**, review the preview, and
select **Save address**. Use **Add address** for another **Topline site name**
or a **Company website**. Address links open in a new tab, and each row has a
copy button. Claiming an address does not deploy or publish a draft and does
not change who can use the app.

Published artifact apps can use a clean address on any company domain connected
under **Account > Domains**. The workspace default is only the initial choice;
an artifact owner can choose another connected domain and path. Select
**Remove** on the **Company website** row in **App addresses** to move the app
back to its Topline address, and move every artifact off a domain before
removing the domain itself. Protected viewers still sign in through
Topline and return to the customer URL. See
[Company domains for artifact apps](/docs/artifact-domains-guide).

To revoke a specific external viewer, select **Remove access** beside their
email under **Add app users** in **App access**. Removing the last app user
turns off live app access; it does not make the app public. Setting **Live app
access** to **Off** and confirming **Turn off live app access** disables the
outside link for everyone while preserving Topline collaboration grants and the
deployed live version. Revoking internal access requires removing the applicable direct,
workspace, company-wide, or scope grants separately.

After a content update, deploy and validate the new draft, publish that reviewed
version live, and recheck the existing saved link and audience. Changing the
address or viewer list alone does not publish the content update.

For documents, reports, and other non-app artifacts, open **Link access**. Set
**Published link access**, add specific people under **Add link viewers**, or
choose **Anyone with the link** for public delivery. **Custom URL and embed**
holds the custom `/s/` URL and embed code, and **Copy link** copies the
published link. These links open the published read-only viewer; add people as
**Viewer** in **Topline access** for draft review.

Never use public access for tenant-private data, credentials, raw PII, or an
unreviewed draft.

## Troubleshoot

- **Not live / publish a live version first:** a deployed draft or a claimed
  app address is insufficient. Return to the artifact, open **App access >
  Publishing**, resolve the blockers listed under **Publishing details**, and
  publish the reviewed version live.
- **Sharing controls unavailable:** confirm you are the artifact owner. Editor
  access alone does not grant owner-only sharing controls; other people see a
  read-only **Topline access** view.
- **Viewer received no invitation:** access changes send no email. Copy the
  saved app link and send it yourself.
- **Sign-in succeeds but the viewer is denied:** check the exact approved email,
  including aliases, and complete email verification when requested. Reopen the
  saved app link using that identity. For internal access, confirm current company
  membership and the artifact or workspace grant.
- **The owner can open it, but the recipient cannot:** the owner has independent
  collaboration access. Test the recipient's link and account in a separate
  browser session.
- **Everyone can still open it:** confirm **Live app access** reads **Only
  people added**, rather than **Anyone with the link**. Reload after a failed save and test a
  signed-out session and an unrelated account.
- **A removed person still has access:** check their remaining direct, workspace,
  company-wide, and scope grants. Removing one grant does not remove the others.
- **The link shows an older app:** check the live version; a newer draft is not
  visible through the live link until published.
- **Custom URL fails:** use the saved Topline address to isolate an address issue.
  A company domain must show **Connected** before its URL is ready. Follow the
  [domain troubleshooting guide](/docs/artifact-domains-guide#troubleshooting).

## Related guides

- [Publishing](/docs/artifact-publishing)
- [Topline collaboration access](/docs/artifact-topline-access)
- [Addresses and embeds](/docs/artifact-addresses)