Skip to content

Sharing and regenerating links

A public status page has no login. Its entire access model lives in the URL:

https://{workspace}.upall.app/status/{token}

The token is a random 40-character string. Nobody will guess it, no crawler will stumble onto it — but anyone who has it can open the page. That's the trade a status page makes deliberately: zero friction for the people you send it to, in exchange for the link itself being the key. Treat it accordingly.

What that model means in practice

  • Sharing the link is granting access. There's no second gate behind it — no account check, no email verification. Whoever receives the URL, by whatever route, sees the page.
  • Forwarding works. If your contact at a client pastes the link into their company chat, everyone in that chat has access. That's usually exactly what you want from a status page — and worth remembering when you decide what the page shows. The content toggles exist for this reason, and the page never reveals targets, hostnames, or IPs regardless.
  • There's no per-person access. You can't give the link to ten people and later cut off one of them. Revoking access means replacing the link for everyone (below). If you need to know who is looking, or need access that follows a person, that's the client portal — real accounts, signed in, one client each.

Who to share with

Send the link to the people who would otherwise call you: your contact at the client, their IT team, their operations channel. Many MSPs create one page per client and send each client only its own link — separate pages mean separate tokens, so one client's link never shows another client's systems and can be rotated without disturbing anyone else.

Search engines are told to stay out

Every status page is served with a noindex instruction, so well-behaved search engines won't index it. That keeps the "unguessable" property honest — an indexed URL is no secret at all. But noindex is not secrecy: it stops crawlers, not people. The link stays exactly as private as the people holding it keep it.

Regenerating the link

On the Status pages list, the Regenerate link action (with a confirmation step) mints a fresh token for the page. The effect is immediate:

  • The page gets a new URL.
  • The old URL returns "not found" from that moment on — for everyone, everywhere, with no grace period.

Treat it exactly like rotating a password. Reach for it when:

  • the link has spread wider than you intended — pasted somewhere public, included in a screenshot;
  • a contract with a client ends and their team should stop seeing the page;
  • someone who had the link leaves the client's company and there's reason to care.

After regenerating, send the new URL to everyone who should still have it — they're cut off along with everyone else until you do.

One nuance worth knowing: regenerating replaces the key but keeps the page up at its new URL. If you want the page gone rather than re-keyed, turn its Published toggle off instead — the URL stops working and no new link exists until you publish again. Your configuration is kept either way.