Solutions
Most static hosts give you a URL and stop there. That is fine until the page is a client's numbers, an internal dashboard, or a draft that should not be readable by whoever the link gets forwarded to — and then you are writing authentication for something that was supposed to be a file upload.
These pages cover the parts of pagegoat that exist so you do not have to write that. The gate is part of the hosting rather than something you bolt on top of it.
No auth code required
Put a password in front of a static site without building a login. The gate runs on the server, so page bytes are never sent until the password is accepted — unlike client-side scripts that ship the whole page and hide it with JavaScript.
You keep the list
Ask every visitor for an email before the page loads, confirmed by a six-digit code if you want the list to be worth having. Restrict it to one company's domain, and export what you collect as CSV.
The strongest of the four
Access attached to a person rather than to a secret that can be pasted anywhere. Everyone else gets a not-found rather than a sign-in wall, and each reader carries their own role.
Open, and optionally unlisted
No gate at all, plus the separate switch that keeps a public page out of results — and the honest limit: an unguessable URL is not privacy, whatever it feels like.
Once the link is out
Reviewers select the passage they mean and comment on it in place. Reply under the quote, resolve what is fixed, and keep every comment when the next draft is uploaded.
Looking for this from the other direction — you have a document and want to know how to hand it over? Start at use cases. Setting visibility from a script or an assistant is covered in the API and MCP docs.
The check happens server-side. A reader who guesses the URL without the password receives the gate, not the page with the content sitting in view-source underneath it.
Public for anyone with the link, password for one shared secret, private for named people by email, or capture to ask each visitor for an address first. Switching between them is one setting and never changes the URL.
Every visibility change is an API call, so a CI job or an AI agent can publish something gated by default and widen it later rather than the other way round.