Choosing the right access setting

Every time you share a room, you pick one of three access settings. Each trades off friction for verification. Pick the one that fits the sensitivity of the content.

The three modes at a glance

Personal magic link bypasses the mode. Whichever access setting you pick, an invited participant who clicks their own personal magic link (the one Katalyz emailed them) lands directly in the room — no email prompt, no code, no allow-list check. The access setting only kicks in when someone arrives via the plain room URL instead.

1. Anyone with the link

Open access — no allow-list, no code. Behavior depends on how the visitor opens the room:

• Via the personal magic link (the one Katalyz sends to invited participants by email) → they're logged in directly, no prompt. Activity is attributed to their identity.
• Via the plain room URL (e.g. someone forwarded it, or pasted it) → the visitor is asked for an email before continuing. The email is not validated against an allow-list — anyone can type anything — but it gives some attribution and tracking.

So it's not "zero friction in all cases" — there's still an email prompt for raw URL visitors. What it doesn't do: verify that the typed email belongs to the visitor, or restrict who can claim to be whom.

Use for:

• Publicly shareable content (case studies, generic demos, marketing material)
• Early-stage prospecting where friction kills interest

Don't use for:

• Pricing, contracts, confidential business info
• Content you don't want forwarded or indexed

2. Authorized emails only

You list specific emails. When someone opens the link, they enter their email — if the typed string matches one in your allow-list, they get in.

It's a string match, not real email verification. No code is sent, no link is clicked to prove ownership. If a visitor knows (or guesses) an authorized address, they pass through claiming to be that person. So this mode raises the bar on "who can wander in" but doesn't prove identity. For that, use Magic code verification.

Authorized users do get sent their own personal magic link by email when you invite them — so legitimate participants don't need to re-type anything.

Use for:

• Active sales conversations where you know who should see the room
• Internal collaboration with named team members
• Content sensitive enough to warrant gating, but not critical

Strengths: tracks activity per person (accurate analytics for participants who arrived via their own magic link), keeps random forwarded opens out, low friction.

3. Magic code verification

Buyers enter their email → receive a 6-digit code → enter the code to access.

Use for:

• Pricing, contracts, legal documents
• Signature workflows
• Compliance-sensitive content
• Deals where you want highest-assurance identity verification

Strengths: prevents link-sharing attacks, establishes email ownership at time of access.

Tradeoff: adds a step. Buyers sometimes don't receive the code (spam filters, corporate gateways) — see Magic code isn't arriving.

How to change the mode later

You can change a room's access setting anytime. Existing authorized users keep access unless you revoke manually.

1. Open the room.
2. Click Share (top right).
3. Change the access setting.
4. Save.

Example reasoning (illustrative only)

Just as one possible way to think about it — the right choice depends on your own context, policies, and risk tolerance:

• Public content (case study, generic demo)? Some teams pick Anyone with the link.
• Active sales conversation with a known buyer? Some pick Authorized emails only.
• Pricing, contracts, signatures, compliance-critical content? Many lean on Magic code verification.

Your team should establish its own guidelines based on the sensitivity of the content and the regulatory environment you operate in.

Related articles

• How magic links work
• [Inviting buyers](→ 02-rooms/08-sharing-access/04-inviting-buyers)

Updated on: 18/06/2026