Share links let you give anyone with the link — no account needed — read-only access to everything tagged with a chosen keyword: media items (photo/video keywords) and pages (user keywords). The link is an unguessable token; holding it is the permission.
Tagging is live: adding or removing the keyword on content immediately changes what the link shows. Nothing is snapshotted.
Whether you may create, list or revoke shares is decided by policy — the permissions your roles grant — never by the name of a role. In the shipped configuration the admin and editor roles may; an administrator can grant the permission to other roles in the instance configuration.
A share hands anonymous read access to content, so it is treated like any other credential the system issues: creating one and revoking one are both recorded in the audit trail before they take effect, and if the record cannot be written the share is refused rather than created unrecorded.
/media/keyword/...): pick an expiry in the dropdown and press Share./shares: enter a keyword, pick an expiry, press Create.Either way you land on /shares with the new link highlighted — use the copy button and send it to your recipients.
| Choice | Meaning |
|---|---|
| 24 hours | Link stops working one day after creation |
| 7 days | Default — good for sharing with family after a trip |
| 30 days | Longer-running projects |
| Until cancelled | Never expires; works until you revoke it |
Expired and revoked links return the same not-found page as a link that never existed — visitors cannot tell the difference.
A share is a delegation: it hands out a slice of what you could do at the moment you created it — read pages and media carrying the keyword — and never more than you hold. Every visit is checked against your current permissions, so if your access is later reduced, every share you issued stops working at the same moment. A visitor with the link is treated as an anonymous reader carrying your delegation, and every page and media item is checked by the same rules that apply to anyone opening it directly; the share link adds nothing a page's own settings withhold. Someone who is signed in and opens a share link sees what the share shows, not what their own account would.
On /shares, press Revoke next to any active or expired share. Revocation is immediate — the link stops working on the next request. You can revoke your own shares; a system administrator can revoke anyone's. Revoked shares stay in the list for the audit trail.
Some content is excluded from every share, no matter what keyword it carries:
owner-only — media and pages alikeA shared page is rendered read-only, but links inside its content point at the normal /view/... URLs. Anonymous visitors following those links may hit a login or not-found page — only content in the share's scope is reachable through the share link itself.
| Event | When | Recorded before the action? |
|---|---|---|
share-create |
A share is created | Yes — a share that cannot be recorded is not created |
share-revoke |
A share is revoked | Yes — a share that cannot be recorded stays live |
share-access |
A link is used | No — visits are rate-limited and written as aggregated counts per share |
Each record names the share and the account that created or revoked it. A visitor using a link is anonymous; what they saw is attributed to the share, and through it to the account that issued it.
Configuration keys and the audit event switches are documented in the admin reference (docs/admin/Share-Links.md in the source repository); every event above can be switched off or have its failure rule changed under ngdpbase.audit.events.