Skip to main content
  • The URL is /v/<secret>/ on the instance (or on the dedicated viewer origin when the operator set one). The secret is 48 random bytes, stored hashed: the URL appears exactly once, when the link is created, and can never be retrieved again. To hand a deck out again, create another link.
  • Every link has an owner-facing Recipient label (alice@client.com, Review round 2) that the recipient never sees. One recipient per link is the intent: each link is observable and revocable on its own.
  • Anyone with the URL is a recipient. Forwarding the URL forwards the access; revoking the link cuts it for everyone holding it.
The deck itself renders under a browser sandbox on the link: no cookies, no storage, no credentialed call reaches the instance from a deck’s own script (viewer security model). Each link decides, on its own, what the recipient gets: The switches can be changed after creation (the version, the capabilities, the expiry and the password are all editable on the API with a PATCH; the version from the page and the CLI too). Each link also counts: its views (entry loads, one per browser within a short window), when it was last opened, and its downloads. Link analytics keeps one event per view, with the referring site and a placement label and without any IP address.
  • The deck’s page: Share in the title menu opens the share sheet, Links are made here, on top of the deck, with New share link, which opens the form in a dialog over the sheet. The form asks for the recipient, the version, the three switches, the notes button position when annotations are on, the expiry and the password, and answers with the URL once.
  • The dashboard: the share links panel of the deck’s dashboard page, the same form.
  • The CLI: slideless share <id> --name "Alice" prints the URL; --to-version, --annotator, --no-forms, --no-remember, --no-download, --no-bar, --expires, --password set the rest, and --embed adds the website snippets. slideless share-email <id> --to a@x.com b@x.com mints one link per address and mails it. The CLI reference has every flag.
  • The API: POST /api/v1/presentations/{id}/tokens.
  • MCP: slideless_add_share_token.

​
What the recipient gets

The deck, whole, at the version the link resolves to, under a slim bar: the Slideless mark, the deck’s title, the version (v3) and, when the version carries files and the link allows downloads, a Download button whose menu lists each file with its size and Download all for the zip. The bar collapses to a thin handle at the top (its Hide this bar button, or Esc while it has focus) and stays collapsed on that link for the rest of the browser tab; the handle, Show the presentation bar, brings it back. The deck sits under the bar, pushed down by its height, never covered. With the bar off, the recipient gets the deck alone, as it was pushed, and a deck that hands out its files then links them itself, relative to its own URL (downloads/figures.csv, downloads.zip), as Attachments explains. Beyond that, what the link allows: the notes layer on an annotator link, working forms unless they were switched off, the files unless downloads were switched off. What the recipient never gets: the deck’s page, the version history, the other links, the owner’s name, the workspace. A link answers for itself:

​
Revoking

Revoke a link when the recipient should stop: Revoke on the link’s row (the dialog says the link stops opening immediately and that its access stats are kept), slideless unshare <id> --token <tokenId> for one link or slideless unshare <id> for every active link of the deck, DELETE on the API, or the MCP tool slideless_unshare_presentation. Revocation is immediate, and the link’s history stays readable in the dashboard. Deleting the deck kills every one of its links at once. When you look at your own deck on its page or in the dashboard, the frame uses a short-lived preview link the instance mints for you. It expires within the hour and never counts as a view or a download. The dashboard’s share links panel does not list it; slideless tokens and the API do, named Dashboard preview with purpose: preview, so a listing from the terminal can show links you did not create: they are yours, and they die on their own.

​
Embedding

Any share link can render inline on your own site, in a sandboxed frame, with the same switches as the direct link except the bar, which never mounts inside a frame; Embedding decks on your site has the snippets and the limits.