A guest list for a link

Every share link we mint is unguessable in the way only arithmetic can be: fourteen characters drawn from a large alphabet, which puts the number of possible links in the region of ten septillion. Nobody is stumbling onto yours. But the mathematics was never the weak point, and we would be selling you something dishonest if we pretended otherwise. The weak point is the same one it has always been — people, in a hurry, being human. A forward that felt harmless at the time. A paste into the wrong channel. A group chat with one more member than you remembered. Nobody has to be a villain for a link to end up somewhere it was never meant to go; accidents happen, and the work is downloadable at the other end of them.

It is worth being clear about what a share link is: a key that works for whoever is holding it. For most of what a studio shares, that is exactly the right shape — the folder of approved images, the cut going to a client who will forward it to their team anyway, the delivery that simply needs to arrive without anyone creating an account or resetting a password. Friction is where everyday sharing goes to die, so the everyday link stays exactly as open as it has always been, and a revoke is one click if a link outlives its welcome.

But some work is different, and everyone who makes things knows the feeling the moment it arrives. The record nobody outside the band has heard. The campaign three weeks before launch. The rough cut with the ending in it. You want to share it, because sharing is how the work gets finished — and at the same time you want a kind of care that a URL, on its own, cannot give you. For that work there is now a switch on every link called named access, and it is off until you want it.

Flip it on and the people you have named on that share become its guest list. The first time one of them opens the link on a device, it asks for their email; if that address is on the list, a six-digit code arrives, they type it in, and the door opens — once per device, and that is the last they hear of it. The check behind the door runs against the list as it stands this minute, so removing a name locks that person out on their very next request, and adding the drummer’s other address takes a moment when the first one turns out to be an inbox he never reads.

A stranger holding the same link sees a calm page and nothing else. No filename, no artwork, no preview — even the little unfurl a link makes when pasted into a chat goes generic, because a leak should leak nothing. And there is deliberately no “request access” button on that page. A private door with a doorbell invites ringing, by bots and by chancers, and turns your work into something that announces itself. The way in is human and always was: ask the person who sent it to you.

The care continues in places you will never see. Codes are stored the way passwords are, hashed and unreadable even to us; they die after fifteen minutes and a handful of wrong guesses; the page answers identically whether or not an address was ever on the list, so nobody can probe a link to learn who is behind it. And when you email the people you have named, the note tells them a code will be asked of them the first time — friction you were warned about reads as care, where friction that ambushes you reads as breakage.

Now the honest boundary, because trust earned by a feature like this is spent the moment the copy overreaches. Named access decides who gets in. Once someone you trusted is inside, they can download the file — that is rather the point of sharing it — and no honest tool can promise you anything about what happens afterwards. If a named person chooses to be careless with the work itself, no gate we could build would have stopped them, and you should be suspicious of anyone who claims otherwise. What this gives you is the thing you can actually control, made absolute: you set the guest list, the list is live, and a wandering link is inert in every hand you did not name. It raises the bar a long way, and we would rather tell you plainly where the bar ends.

We built this alongside the audio work for a reason. The more generously a link invites people into unfinished work — the notes, the voice memos, the hummed melodies, and one day, we hope, a guest recording their part straight back over an unreleased track — the more it matters whose hands that link is in. Some of what we want to build next is only responsible to build behind a door like this one, so we built the door first.

The feature fits in a sentence, which is how we knew it was finished: keep your work safe by naming who can open your link. Everything else — the codes, the cookies, the live list, the calm page for strangers — is just that sentence, taken seriously.