Create a Public Shared Link

Public shared links provide read-only access to a folder subtree through a tokenized URL.

What this feature is

Scope: folder subtree (not whole repository by default)
Access: read-only public browsing/download
Security model: capability URL, optionally password-gated

Who can create links:

Authenticated users who can manage permissions on the selected root folder.
In community repo-role mode, that means repo ADMIN.

Practical checklist

Select the exact folder you want to share.
Set expires_at (recommended).
Set a password for sensitive content.
Add an optional message for recipients.
Create link and copy the URL immediately.
Distribute through your approved channel.

Recipient flow

Open share URL.
If password protected, unlock with password.
Browse folder content.
Stream file content or download zip.

Share URLs are typically routed as:

https://synckhub.com/s/<infra_key>/<tenant_slug>/<repo_slug>/<shared_folder_link_token>

The tenant_slug and repo_slug segments are there for readability. The token remains the real capability.

Security-critical behavior

Link token is returned only at creation time.
Inactive links (expired/revoked) return not found.
Password-protected links require unlock before browse/download.
Access does not grant write operations.

Zip download behavior

Zip is streamed (large folders do not require full archive buffering first).
Deployments may enforce entry/size safety limits.
Some downloads may return conflict if policy blocks completion.

Revoke access

Revoke links when collaboration ends:

Open Directory > Public links for the paginated repo-wide table, or open the folder share dialog for folder-scoped history.
Revoke it.
Confirm recipients can no longer open it.

The repo-wide Directory > Public links page requires manage permissions on the repo root. If you do not have that permission, the page returns access denied.

Revocation is safe to repeat.

For access behavior, see ../core-concepts/sharing-and-access.md.