Choosing the right access setting

Every time you share a room, you pick one of four access settings under Access settings in the Share modal. Each trades off friction for verification. Pick the one that fits the sensitivity of the content.

The three modes at a glance

Personal magic link bypasses the mode. Whichever access setting you pick, an invited participant who clicks their own personal magic link (the one Katalyz emailed them) lands directly in the room — no email prompt, no code, no allow-list check. The access setting only kicks in when someone arrives via the plain room URL instead.

1. Anyone with the link

No allow-list, no code — but not anonymous either. Behavior depends on how the visitor opens the room:

• Via the personal magic link → they're logged in directly, no prompt. Activity is attributed to their identity.
• Via the plain room URL (forwarded, pasted) → the visitor lands on the room's login page ("Join the conversation.") and enters a Work email before continuing. The email is not validated against a list — anyone can type anything — but it gives attribution and tracking.

What it doesn't do: verify that the typed email belongs to the visitor, or restrict who can claim to be whom.

Use for: early-stage prospecting where friction kills interest, but you still want to know who's reading.

Don't use for: pricing, contracts, confidential business info.

2. Only authorized users

You list specific emails and/or domains. When someone opens the plain URL, they enter their email on the login page — if it matches an authorized address or belongs to an allowed domain (e.g. @acme.com), they get in.

It's a match, not real email verification. No code is sent to prove ownership. If a visitor knows (or guesses) an authorized address, they pass through claiming to be that person. So this mode raises the bar on "who can wander in" but doesn't prove identity. For that, use Access code verification.

Authorized users still receive their own personal magic link by email when you invite them — so legitimate participants don't need to type anything.

Use for: active sales conversations where you know who should see the room; internal collaboration; allowing a whole buyer domain in one go.

3. Access code verification

Visitors enter their email → receive a 6-digit code → enter the code (Verify & access) to get in.

Use for: pricing, contracts, legal documents, signature workflows, compliance-sensitive content.

Strengths: prevents link-sharing attacks, establishes email ownership at time of access.

Tradeoff: adds a step. Buyers sometimes don't receive the code (spam filters, corporate gateways) — see Magic code isn't arriving.

What every visitor sees after login

Whatever the mode, the login page is the same: your logo and the buyer's, the heading Join the conversation. (or Welcome back. on a return visit), one Work email field and Continue. Name and job title are not asked at login — about a minute later, a discreet Mind introducing yourself? card offers optional First name / Last name / Job title fields (Not now / Save). See How magic links work.

How to change the mode later

You can change a room's access setting anytime. Existing authorized users keep access unless you revoke manually.

1. Open the room.
2. Click Share (top bar).
3. Pick another option under Access settings.

Example reasoning (illustrative only)

Just as one possible way to think about it — the right choice depends on your own context, policies, and risk tolerance:

• Early prospecting where you still want to know who opened it? Some pick Anyone with the link — one email, no code.
• Active sales conversation with a known buyer? Some pick Only authorized users and allow the buyer's domain.
• Pricing, contracts, signatures, compliance-critical content? Many lean on Access code verification.

Your team should establish its own guidelines based on the sensitivity of the content and the regulatory environment you operate in.

Related articles

• How magic links work
• Inviting buyers
• Sharing your first room

Updated on: 04/10/2026