Access & sharing | Spacefast
Show it to your people, not the whole internet.
Every new space starts Private: a bare URL does not grant access. Invite people, issue scoped links, or choose Public. You can revoke grants later.
Private is the default, not a cleanup step
Nothing is reachable until you say so. Then you add only the access a person or a visitor needs:
You, from the publish receipt
Every publish hands back an access link that is just for you. Opening it signs your browser in and lands you on the live URL.
People, invited by email
Invite someone as a Viewer, Commenter or Editor, for the whole space or just the paths they need. Reviewers and agents never add a seat charge. The rest is on pricing.
Links, no account required
Hand out a link that grants View or Comment access on its own. Scope it to one path pattern or many, add an expiry if you want one. Whoever opens it is in, no account required.
Access requests
Someone who reaches a space they can’t see can knock. You approve or deny the request without opening the space yourself.
Team and Public, when you mean it
One switch opens the space to your whole team, or to everyone. The space never moves and its history stays put. Only who can reach it changes.
The presets, People and Links all read from one grant model: paths, roles, constraints. Comments follow the same access as the pages they sit on.
Taking access back is the point.
Sharing you can’t undo isn’t sharing, it’s publishing. Remove the authority and it stops working:
Revoke a Link
Every copy of that link stops working, wherever it was forwarded. Your other Links are untouched.
Remove a person
Only that person’s access disappears: their roles, their paths, nothing else.
Log everyone out
Invalidate every browser session at once, without changing who is invited. Useful when a laptop goes missing, not just when trust does.
Choose Public explicitly
Going public is a decision, never a drift. Only the public grant changes, and it changes back the same way.
Three URLs, three jobs
The address of a space, permission to read it, and ownership of it are separate on purpose.
Live URL
The space’s stable address. Sharing changes never move it.
Access URL
Permission for a browser: opening it signs you in, then redirects to the live URL. Integrations send the same token, or their own API key, in X-SF-Authorizationinstead.
Claim URL
Proof of ownership for a space published without an account, until you sign in and claim it as yours.
Your agent can do all of it
Every sharing action is one command from the CLI, the API, or MCP. No dashboard required.
Start private, then share deliberately:
sf share link create --name "Client review" --path '/report/**' --role commenter --expires 7d
sf share grant --to public --role viewer --path '/assets/**'
sf share people invite ana@studio.example --role editor
Spacefast is in research preview.