Link access
Some pages are one group's business and nobody else's. Upload the file, set the link to private, and name the people who may open it by email address. Everyone else — including whoever the link gets forwarded to — is told the page does not exist.
This is the strongest of the four access modes, because what holds the access is a person rather than a string. A password can be pasted into a group chat and an email address can be typed by anyone; a grant belongs to one account and comes back when you take it back.
Named by email
Everyone who may read the page has their own grant. Add one, change one, or revoke one without disturbing anybody else and without the URL moving.
A real 404
Not a sign-in prompt, which would confirm the page is there. A forwarded link tells the person holding it only that the address does not resolve.
Viewer · commenter · admin
The only mode that can tell its readers apart, so one person can mark the page up while the rest of their team reads it. A gate handing out one shared role cannot do this.
The people you invite need an account. It is free, it takes a moment, and a free account can read the page, leave comments and help manage sites shared with it — what it cannot do is publish its own. But it is a real step, and it is the step that decides whether this mode fits your reader.
An invitation is recorded against the address you named and applied the first time that person signs in, so there is no window where they hold a link that does not work yet. If your reader is a client who will not create an account to read one document, that is not a failure of the mode — it is the mode telling you to use a password instead, which asks them for nothing but a secret you already sent.
Set the mode, then add people. Both are ordinary API calls, so a pipeline can publish something restricted by default and widen it later rather than the other way round.
# Publish, then restrict it to named people
curl -X PUT https://api.pagegoat.com/api/sites/q3-review/visibility \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"visibility":"private"}'
# Invite one person at a time, each with their own role.
# Roles: viewer < commenter < admin. The site owner is always admin.
curl -X POST https://api.pagegoat.com/api/sites/q3-review/invites \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"email":"dana@northloop.co","role":"commenter"}'
# See who can reach it, and revoke a pending invite
curl https://api.pagegoat.com/api/sites/q3-review/access \
-H "Authorization: Bearer $TOKEN"
curl -X DELETE https://api.pagegoat.com/api/sites/q3-review/invites/$INVITE_ID \
-H "Authorization: Bearer $TOKEN"An AI agent connected over MCP can set this mode — it is one of the three its set_visibility tool accepts — which is why a page an assistant creates for you starts private until you widen it.
Yes, and it is free. An invitation is recorded against the address you named, and the access is applied the first time that person signs in — so they create a free account, and from then on the link works for them. A free account can open pages shared with it, read and leave comments, and help manage sites it has been given access to; it just cannot publish its own. Nobody you share with ever needs a paid plan and there are no seats to buy for a reader. It is still a real step, so if your reader will not create an account for one document, use a password instead.
A not-found page, with a genuine 404 status — not a sign-in prompt. That is deliberate: a login wall confirms the page exists, which tells anyone who guesses or is forwarded the URL that there is something there worth guessing at. A private site should look absent rather than withheld, so the server answers as though the slug does not resolve at all. The practical consequence is that forwarding the link achieves nothing. Somebody who was sent it by a colleague and is not on the list will tell you the link is broken, and the honest answer is that they need adding.
Yes. Each person's grant carries a role: viewer reads the page and existing comments, commenter can also leave and reply to notes, and admin can change the site itself. They rank, so admin covers everything a commenter can do. Roles are per person rather than per link in this mode, which is the difference between private and the other three — a password or an email gate hands every visitor the same role, because it has no way to tell them apart. Give the client commenter and their wider team viewer when you want one voice on the page and several readers.
Private when you need to know who read it and to remove one person later; a password when the reader will not create an account and the group is loose or temporary. The trade is real in both directions. Private is stronger, because access is attached to a person rather than to a string that can be pasted into a group chat, and revoking one grant does not inconvenience anyone else. A password is easier, because a reader needs nothing but the secret and can be through in four seconds. Neither changes the URL, so a page can start private for review and open up afterwards.
Publishing starts at $2.99/month. Reading and commenting are free, and there are no seats to buy for someone who will open one document once.
pagegoat.com/sites/your-report
See plans