Guests & Sharing
Two ways to show work to someone who is not on a paid seat: invite them as a free read-only guest, or publish a project behind a public link that needs no Lithora account at all.
Payments rebuild
Migrating checkout off the legacy gateway · In progress · ends Mar 31
No members, no email addresses, no comments, no files.
A public share link renders exactly these fields and nothing else — the projection is enforced on the server, not hidden in the UI.
Which one do you want?
Guest membership
The person signs in with a Lithora account and browses read-only what they have been given access to — boards, backlog, timeline, comments, files. Free, never billed, capped per plan. Use it for a client, a contractor or an exec who needs to look around repeatedly.
Public share link
One project is published at an unguessable URL. No account, no sign-in, no seat. The visitor sees a stripped status page and nothing else. Use it for a status update you send outside the company.
The guest role
A guest is a real membership on the team with the role guest. Every write path checks it, so a guest is read-only everywhere — not just in the parts of the UI that remembered to hide a button.
- Can: read everything they are given access to — projects, work items, docs, files and comments.
- Cannot: create, edit or delete anything — including dragging a card to a new status, which is otherwise the lightest write an ordinary member can make. Guests also cannot restore or purge from the Trash.
- Never billed: a guest is excluded from the seat count that drives your invoice, so adding one never changes what you pay.
What a guest sees when they try to write
GUEST_READ_ONLY and the message “Guests have read-only access. Ask a workspace admin to upgrade you to a member seat to make changes.” Upgrading is a role change on the membership — at that point they take a normal paid seat.Guest limits by plan
| Plan | Free guests per team | Cost per guest |
|---|---|---|
| Pro — $10 per seat / month | 5 | $0 |
| Scale — $29 per seat / month | 25 | $0 |
| Locked (no active trial or subscription) | 0 | — |
The cap is per team, so a Pro account with its 5 teams can hold 5 guests in each of them. Members still count against the member limit (20 per team on Pro, 50 on Scale); guests do not.
Inviting a guest
- Go to Dashboard → Teams, open the team, then Members.
- Click Invite members.
- Enter one or more email addresses, separated by commas or spaces.
- Set Role to Guest (read-only, free). The charge estimate switches to “Guests are free”.
- Send. The role is applied when the person accepts the invite.
Invites are free either way
If a guest invite fails, the join is rolled back
Public share links
Publishing a project mints a random 32-byte URL-safe token and serves a read-only page at/share/<token>. The token is the only credential — anyone holding the link can open the page, and nobody without it can guess one.
- Open the project and click Share in the header (the dialog is titled “Share to web”; it calls a project a container).
- Click Create public link.
- Copy the URL with the Copy button and send it.
- To turn it off, reopen the dialog and click Revoke link.
Only a workspace owner, a workspace admin, or the person who created the project can publish or revoke it. Everyone else sees “Only a workspace admin or the container owner can publish this container.”
Exactly what a public link exposes
Visible to anyone with the link
- Project name and description
- Project status, start date and end date
- Each work item: title, status, priority and due date — the response also carries the item's tags, so treat a tag name as public
Never exposed
- Member names, email addresses and assignees
- Comments, descriptions of work items, attachments and files
- Internal ids — nothing on the page can be replayed against a signed-in API
- Anything you deleted: trashed work items and trashed projects disappear from the public view immediately
A public link is public
Expiry and revocation
- Expiry: a link created from the Share dialog has no expiry — it stays live until it is revoked. An expiry of 1 to 365 days can be set when the link is minted through the API, after which the page stops resolving on its own.
- Revoking is immediate: the next request on the old URL fails. There is no cache window and no grace period.
- Re-sharing mints a new link: publishing again after a revoke produces a different token. The old URL is dead permanently — you cannot un-revoke.
Why a broken link is never specific
Publishing a workspace page
A page in a workspace can be published behind its own token, with the same optional expiry and the same immediate revoke. The public view returns the page title, icon and content — and, as with projects, no member identities. A workspace admin or the person who created the page can publish it.
API only for now
POST /api/pages/<page_id>/share (optionally{ "expires_in_days": 30 }) and revoked withDELETE /api/pages/<page_id>/share. Project links have a full UI — use the Share button above.Troubleshooting
- The Share dialog says only an admin can publish: you are neither a workspace owner/admin nor the creator of this project. Ask one of them to publish it.
- A guest reports a button does nothing: they hit the read-only refusal. Change their role to member (which takes a paid seat) if they need to edit.
- The public page is missing a work item: the item is either in the Trash or has no title — the public projection lists only live work items. See Trash & restore.
- You want a client to comment: that is not what either surface does. Both are strictly read-only; a person who needs to write needs a member seat.