> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Resource sharing

> Share dashboards and reports with signed-in users, another workspace, or a restricted public link.

MoleSignal shares a specific dashboard or report. A share link never becomes a normal user token.

## Share modes

| Mode            | Audience                                      | Authentication                                                   |
| --------------- | --------------------------------------------- | ---------------------------------------------------------------- |
| Authenticated   | Users already allowed to access the resource. | Normal sign-in.                                                  |
| Cross-workspace | A selected organization, team, or user.       | Sign-in plus an approved cross-org grant.                        |
| Public link     | Anyone holding the restricted bearer link.    | Short-lived share session; dashboards always require a password. |

## Public-link protections

The opaque `/s/{token}` link is exchanged for a short-lived, HttpOnly share session. Public
dashboard requests can run only saved panel queries through a constrained proxy. The browser
cannot submit arbitrary SQL or PromQL.

A share can enforce:

* expiration;
* maximum view count;
* password (required for dashboards; workspace policy decides for reports);
* download permission;
* fixed dashboard time-range and variable constraints;
* revocation and token rotation.

Public dashboard downloads are disabled. Public report downloads follow the share and workspace
policy.

## Workspace policy

Open **Settings → General → Sharing and public access** to control:

* whether public links are allowed;
* whether live dashboards can be public;
* maximum public-link lifetime;
* required passwords for public reports;
* blocking public shares for resources tagged `production` or `prod`;
* public CSV downloads.

Use an authenticated or cross-workspace share when public policy blocks the resource.

## Audit and revocation

Share creation, access, rotation, and revocation are audited. Revoke a share to stop future
sessions, or rotate the share when the URL may have leaked.

The resource share permission, such as `dashboards.share`, is required. MoleSignal re-authorizes the
source resource before creating a share.

<Warning>
  A public URL is still a bearer credential. Do not place sensitive data in the shared view, even
  when the link expires or uses a password.
</Warning>