Share a file with a contractor

Sometimes a person outside your team needs a secret: a contractor setting up an integration, or a colleague from a partner company. Instead of pasting the value into a chat, send a share link. It opens in their browser, the file is decrypted there, and the link stops working after the limits you set.

Example. Kiteline is a fictional company. Luis Ortega from a design studio needs the Stripe test keys from payments-api / staging for one afternoon. Priya sends him an expiring link for one view, protected with a password.

1. Create the link

1. Open the environment and choose Share links, then New link.
2. Pick the files to share. Share only what's needed, for example one .env file.
3. Choose the kind:
   • Expiring: stops working after its time and view limits.
   • Live: the recipient always sees the latest version, until you revoke it. It has no expiration.
4. For an expiring link, set how long it's valid, such as 1 day, and How many times it can be opened, such as once.
5. Tick With password and set the link's password. While the link works, its row in the list lets you copy the password again.
6. Optionally, give the link a name you'll recognize later. By default it's named after the services of the chosen files.

Link created shows the address. The key that decrypts the files is in the part after #. Browsers never send that part to the server.

You can create links if you can save versions of the environment: Editors, owners and admins. Each account can create up to 100 new links a day.

2. Send it

Send the link and the password through different channels, for example the link by email and the password in a call. Anyone who has both can open the files.

If the environment has a network rule that blocks share links, you can't create one. See Network rules.

3. What the contractor sees

The page says Files have been shared with you and waits for them to choose Open. A messenger generating a link preview doesn't use up the view. With a password, they enter it first.

After opening, the page shows owner's signature verified, so they know the files weren't swapped on the way. They can show, copy or download each file, or install the files on a computer or a server with a downloaded script.

If that was the last allowed view, the page tells them the link no longer works and asks them to save the files now. Close and wipe from memory clears the decrypted files from the page.

4. Watch and revoke

The environment's Share links list shows the link's state, views as used of allowed, and when it expires. States are Active, Used, Expired and Revoked. Opening the link is recorded in the audit log.

When the work is done, revoke any link that's still active: Share links, the link, Revoke. A live link must always be revoked by hand.

5. Reissue the value

Revoking a link stops future opens. It can't take back a file someone already opened. If you shared a real secret, such as a production API key, reissue it at the provider after the work is done and save the new value in the environment.

Choosing the settings

The limits are up to 365 days and up to 1,000 views for an expiring link.