Docs

Expiry and passwords

A link can stop working after a time you set, and a document can ask readers for a password.

Expiry

Pass expires_in as a whole number with m, h or d: 30m, 24h, 7d. It counts from now. After it the link shows “Link expired” (HTTP 410) and comments stop. You keep full access with your key and can extend the link or remove the expiry. 30 days after it expired, the document is deleted for good with all versions and comments.

Password

Pass password in MCP, the X-Ashare-Password header in REST or --password in the CLI. ashare never takes a password in the URL. Each reader enters it once per browser, and a cookie keeps them in for 7 days. ashare stores only a hash, so keep the password yourself. A new password signs every reader out. A reader gets 10 tries a minute.

On a public document anyone with the link and the password gets in, no email code. On a private one readers pass the email check first, then the password. With your key you never need it.

Change or remove

REST

curl -X PATCH 'https://ashare.net/api/artifacts/<id>' -H 'Authorization: Bearer <key>' -H 'Content-Type: application/json' -d '{"expires_in":"30d","password":null}'

CLI

$ ashare protect <id> --expires 30d --remove-password
$ ashare protect <id> --expires ""

A field left out stays; null or an empty string removes it. In MCP, protect takes the same fields. A default expiry for new documents lives on Settings.