--- title: A preview token is not a standing permission grant description: Shareable preview links used for design reviews and stakeholder demos often become de facto standing access grants due to weak scoping and lifetime controls. A... canonical: https://daily.dev/posts/a-preview-token-is-not-a-standing-permission-grant-5heygtelj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A preview token is not a standing permission grant | daily.dev og:description: Shareable preview links used for design reviews and stakeholder demos often become de facto standing access grants due to weak scoping and lifetime controls. A... og:url: https://daily.dev/posts/a-preview-token-is-not-a-standing-permission-grant-5heygtelj og:image: https://api.daily.dev/og/posts/5HeYGtelJ.png og:image:alt: A preview token is not a standing permission grant og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A preview token is not a standing permission grant **[Auth By Example](https://daily.dev/sources/7eadcwhmohx0bchehapmt)** · [@authbyexample](https://daily.dev/authbyexample) · 2 min read · 0 upvotes · 0 comments ## Summary Shareable preview links used for design reviews and stakeholder demos often become de facto standing access grants due to weak scoping and lifetime controls. A checklist is offered for treating preview access as a narrow, time-bound authorization decision: scope tokens to exact resources, bound their lifetime and usage, separate preview from editor privileges, revoke tokens on publish/archive/permission changes, and log all access. A quick test is suggested — revoke or expire a draft and confirm the old preview URL no longer returns content — to verify the implementation isn't a hidden permanent backdoor. ## Content Shareable preview links are convenient for design reviews and stakeholder demos. They are also easy to leave wider and longer-lived than anyone intended: a UUID in a URL, no login, and a handler that treats "has the token" as "may see everything related to this project." Treat preview access as a narrow, time-bound authorization decision: 1. Scope the token to exact resources (this draft, this environment), not "the whole tenant" or every future attachment uploaded to the same folder. 2. Bound lifetime and use: short TTL, optional single-use or view-count caps, and no silent refresh that turns a review link into a permanent backdoor. 3. Separate preview privileges from editor privileges. A reviewer token should not mutate, download bulk exports, or invite others unless that is an explicit, audited capability. 4. Revoke on publish, archive, or permission change. When the underlying object's ACL tightens, outstanding preview tokens must die with it — do not keep serving from a mint-time snapshot alone. 5. Log access: which token, which resource, from where, and whether it was revoked mid-flight. Preview traffic is still access to real data. Quick check: mint a preview link for a draft, then remove the reviewer's access (or expire the draft). If the old URL still returns content, your preview path is a standing grant pretending to be temporary. Preview means temporary, scoped read. If the URL outlives the review, it is just an unauthenticated API key with a nicer name. ## Similar posts on daily.dev - [Project-scoped Tokens](https://daily.dev/posts/project-scoped-tokens-dcz6uakob) · Vercel · 0 upvotes · 0 comments - [A Stolen Token Is Useless. A Stale One Still Works.](https://daily.dev/posts/a-stolen-token-is-useless-a-stale-one-still-works--1mcdf6whq) · API Evangelist · 1 upvotes · 0 comments - [Limit token exposure with fine-grained PATs](https://daily.dev/posts/limit-token-exposure-with-fine-grained-pats-eceamdfew) · GitLab · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#authorization](https://daily.dev/tags/authorization) [View this post on daily.dev](https://daily.dev/posts/a-preview-token-is-not-a-standing-permission-grant-5heygtelj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/a-preview-token-is-not-a-standing-permission-grant-5heygtelj","headline":"A preview token is not a standing permission grant","text":"Shareable preview links used for design reviews and stakeholder demos often become de facto standing access grants due to weak scoping and lifetime controls. A checklist is offered for treating preview access as a narrow, time-bound authorization decision: scope tokens to exact resources, bound their lifetime and usage, separate preview from editor privileges, revoke tokens on publish/archive/permission changes, and log all access. A quick test is suggested — revoke or expire a draft and confirm the old preview URL no longer returns content — to verify the implementation isn't a hidden permanent backdoor.","url":"https://daily.dev/posts/a-preview-token-is-not-a-standing-permission-grant-5heygtelj","datePublished":"2026-09-30T10:48:22.801Z","dateModified":"2026-09-30T10:48:39.874Z","author":{"@type":"Person","name":"Auth By Example","url":"https://daily.dev/authbyexample","image":"https://media.daily.dev/image/upload/s--Fgz7IgGQ--/f_auto/v1789653205/avatars/avatar_7EADCwHmOHX0bChEhAPmt?_a=BAMAMicg0","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":30}},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/7eadcwhmohx0bchehapmt","name":"Auth By Example"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Auth By Example","item":"https://daily.dev/sources/7eadcwhmohx0bchehapmt"},{"@type":"ListItem","position":3,"name":"A preview token is not a standing permission grant"}]} ```