Share Link Invitations and Sessions

A Share Link invitation identifies an invited email address. When Access Control is enabled, it also limits each invitation URL to the first browser session that uses it. Understanding these separate roles helps you interpret visitor activity and decide whether to require email verification.

Invitations and Identity

Each recipient receives a different invitation URL. Activity through that invitation is associated with the invited email address, including when someone else opens a forwarded copy. The address in the activity record identifies the invitation used; the invitation alone does not establish who is using the browser.

Email-based one-time passwords add a check that the visitor can obtain a code sent to the invited mailbox. This is useful when access must depend on control of that mailbox as well as possession of the invitation. A shared mailbox or a code passed to another person still does not establish an individual person's identity.

Invitation Reuse Across Browsers

With Access Control enabled, the browser that first opens an invitation establishes a session. Opening the same invitation in another browser, another device, or a private browsing session requires a replacement invitation. Files.com sends the replacement to the invited email address and invalidates the original invitation for new sessions. Replacement emails are limited to one per recipient per Share Link every 15 minutes.

The existing browser session keeps its access. Replacing an invitation changes how someone starts a session; it does not end sessions that already exist. Each recipient's invitation is handled independently, so opening one recipient's invitation does not invalidate another recipient's invitation.

For example, if Morgan forwards an unused invitation to Lee and Lee opens it first, Lee establishes the first session. Activity is associated with Morgan's invited address. When Morgan opens the same invitation in a different browser, Morgan needs the replacement sent to their mailbox. Requiring an email-based one-time password adds the mailbox check before Lee can access the share.

Changes to Existing Access

Enabling Access Control on an existing Share Link restricts new access without ending existing visitor sessions. To end access for all visitors, revoke the Share Link. A new Share Link can then use the required password or recipient restrictions.

Revocation cannot retrieve files already downloaded or content already loaded in a browser. File requests already authorized through temporary URLs also have their own expiration rules. Those limits are separate from the invitation and Share Link lifetimes.