Public access & sharing

Overview

Open Settings and choose Public Access (“Manage triggers, endpoints, and shared links across your resources”). The page has eight tabs:

From a workflow, you do not have to look for the right row: right-click a webhook, chat, form, or schedule trigger on the canvas (while editing, or on its production run once the workflow is live) and choose Manage in Public Access. The page opens over the workflow (in a new tab from the standalone builder), on that trigger’s tab, with its row picked out. A chat or form trigger also offers Share link, which opens the share dialog of its public link: copy it, or disable and enable sharing.

Every card shows whether the entry point is Active or Inactive, the workflow it belongs to (or Not linked), an App badge when it belongs to an application you installed, and its creation date. Click the workflow name to open it. The URL on each card has a copy button.

Usage limits

Each tab starts with a usage gauge (“3 / 10 used”). On the cloud, the limit depends on your plan; creating an endpoint or a link past it is refused. The self-hosted Community Edition has no limit.

The shared-link quota is global: the share links of the Chats, Forms, Conversations, Applications, Workflows, and Agents tabs all draw from the same allowance. A link you switch off still counts; delete it to free its place. When it is full, sharing shows Shared link limit reached with a link back to this page so you can delete unused links.

Webhooks

Each webhook card shows the full URL, the HTTP method it accepts, its authentication type when it is not public (Basic Auth, Header Auth, or JWT Auth), and a cURL button with a ready-to-run example.

Read the call history

Choose View Logs to open the Call History: ten calls per page, each with its outcome, how many workflows it triggered, and when it arrived. The outcome is triggered (at least one workflow started), no_active_workflow (the call was accepted but no workflow was live to run), budget_reached (the workflow has spent its cost budget, for the period or in total for a cap that never resets, so nothing ran and the caller received 402), or inactive (the webhook is switched off). A call that is refused before it is accepted (wrong credentials, wrong HTTP method) gets its error response and is not recorded here, so an empty history can also mean the caller is being refused.

Regenerate a token

1. 1
   Open the card menu

   On the webhook, chat, or form card, open the actions menu.
2. 2
   Choose Regenerate Token

   Confirm the prompt: “This will invalidate the current URL.”
3. 3
   Update your callers

   Copy the new URL from the card and update every system that called the old one. The old URL stops working at once (a webhook answers 404).

Regenerate a token whenever a URL may have leaked. It is the only way to change a webhook's URL: saving or re-pinning the workflow keeps the same token.

Public chats and forms

A chat trigger gets a public chat endpoint, and a form trigger gets a hosted form page. Both are reachable without a login by anyone who has the URL. A chat card shows a Memory badge when conversation memory is on, which shows the conversation history to visitors.

Each tab has two views: Endpoints (the endpoints themselves) and Shared Links (links you created with Share). A shared link is a separate public URL of the form {base}/s/{token} that you can disable or delete without touching the endpoint. To cut off a URL that may have leaked, regenerate the endpoint's token: the chat or form also opens by it. The API behind a public chat is described in REST API & webhooks.

Schedules

The Schedules tab lists every schedule with its cron expression and timezone, how many times it ran, and when it runs next. Choose Disable to stop a schedule without deleting it, and Enable to arm it again. To move one run, run it early, or see schedules on a calendar, use the Agenda.

Share links

A share link makes one resource readable by anyone who has its URL, of the form {base}/s/{token}, without an account. You create it from the resource itself:

A workflow or agent link never shows the settings of a step, a prompt, an agent's instructions, a credential, a run, or a conversation. It shows the resource as it is now: a change you save is visible to the next person who opens the link. On a workflow, the second item of the Share menu, Publish to the marketplace, is a different thing: it lists the workflow as an application others can install.

1. 1
   Confirm public sharing

   The first time, LiveContext asks you to confirm Share publicly: “Anyone with the link will be able to access this resource.” For a workflow or an agent, the dialog also says what will and will not be visible.
2. 2
   Copy the link

   Use Copy link. The dialog also shows Total accesses and Shared since.
3. 3
   Control it later

   From the same dialog, Disable sharing (and Enable sharing again). For an application, a workflow or an agent, Regenerate link also invalidates the old URL; a conversation, chat or form opens by its own address too, so stop one by deleting its link (or, for a chat or form, by regenerating its endpoint's token).

Deleting a link from Public Access revokes it for good: “Anyone with the link will no longer be able to access it.” Deleting a link never deletes what it shared. Each card counts its views. The notification bell also has a Shared tab that lists your active links.

The share page

A share link opens on the resource itself, under a slim bar. On the left, the kind of resource and the link's name. On the right:

An application link is the exception: it is what you send a client, so whoever opens it without managing it gets the application alone, with no bar, no run progress and no epochs (a running submission still shows its progress over the page, and a failed one says so). Every visitor uses the application's one run (the one your own page of the application shows too) and sees its latest submission, so do not show a visitor's answers or results on the pages that follow its form. Members of the workspace keep the bar described below.

• People with access: “Anyone with the link” when the link is on, and who shared it (a chat, form or application link never names a person). Members of the workspace also see the workspace's members and how many times the link was opened.
• Copy link, and Export: a workflow or an agent as JSON (downloaded or copied), and a workflow, an agent, or a conversation printed or saved as PDF.
• The light or dark theme.
• Share, for members of the workspace that owns the link, signed in with that workspace active (with another workspace active, the page looks as it does to anyone): give the link a name and a description, switch “Anyone with the link” on or off, delete it, open the resource in LiveContext, or, for an application, a workflow or an agent, reset the link (a chat, a form or a conversation also opens by its own address, which a reset would not change). They can also click the name in the bar to rename the link in place. Renaming a link never renames the resource. A workspace Viewer sees the same dialog but can only copy the link.

Members of the workspace who open a link that is switched off see that it is off, and all but Viewers can switch it back on, at the same address (for a workflow or an agent, only a member the workspace lets change it). A link that is on but does not open tells them why: the plan no longer includes public links, the link expired, or what it shares left the workspace. Everyone else reads that the link is no longer available.

Agents can share too

An agent with access to a workflow, an application, or another agent can create its share link (workflow share, application share, agent share_profile) and switch it off again (unshare, unshare_profile). Sharing is a sensitive action: the agent asks you first, on an approval card in the chat, every time (“Don't ask again” never covers it). When nobody can be asked (a workflow step, a sub-agent, a scheduled run), the share is refused. The one exception is an agent sharing its own conversation read-only, which is how an agent in a workflow hands over its result. Switching a link off is never asked. An agent can only share what you could share yourself, and never after it has read Google Workspace content in that conversation.

What requires a pinned version

An endpoint can exist and still not answer. Entry points that come from outside run the workflow's pinned production version only.

To pin, open the workflow's version history and choose Set as production. See Triggers for the full pinning rules.

Security notes

• A URL is a credential. Anyone who has a public webhook, chat, form, or share URL can use it. Keep them out of public repositories, and regenerate the token if one leaks.
• Protect webhooks that change data with Basic, Header, or JWT authentication. Authentication fails closed: a caller without valid credentials gets 401.
• A share link is scoped to one resource. It gives access to that conversation, chat, form, application, workflow, or agent, and nothing else in your workspace. A workflow or agent link is read-only: it cannot run anything.
• Public traffic is rate limited. Over the limit, callers get 429 with a Retry-After header. The limits are listed in REST API & webhooks.
• Deleting an endpoint breaks its workflow. When the endpoint is linked, the confirmation names the workflow: “Deleting it will break that workflow.” Disable a schedule instead of deleting it when you only want a pause.

Troubleshooting

Related pages