Alex
Browse docs

Sharing

Publish a collection with a revocable tokenized link

Alex can publish a collection at an unguessable link. Anyone with the link can browse and read that collection without creating an account.

Enable sharing

  1. Open a collection.
  2. Choose Share.
  3. Confirm that you want to enable sharing.
  4. Copy the generated /shared/<token> URL.

Alex keeps the same URL while sharing remains enabled. If you revoke and later re-enable sharing, Alex generates a new token and the old URL stays invalid.

A recipient can:

  • See the collection name and description
  • Browse its books, covers, titles, authors, formats, and PDF page counts
  • Open included PDFs and EPUBs in the same browser readers used by signed-in users
  • Retrieve the file bytes required by those readers through token-scoped endpoints

A recipient cannot:

  • Edit or delete the collection
  • Add or remove books
  • See the owner's account identity
  • Use the token to read a book that is not currently in that collection
  • Browse the rest of the Alex library

A share link is access to the included book content, not a DRM boundary. A browser that can render the file necessarily receives its bytes, and recipients may be able to save them. Share only material you are authorized to distribute.

Reading progress

Public reader progress stays in the recipient's browser. It survives reloads in that browser but does not sync to the server or another device. Alex does not create anonymous user rows.

Revoke access

  1. Open the collection.
  2. Choose Stop Sharing.
  3. Confirm the action.

Alex clears the collection's token immediately. The collection page, cover routes, and book-file routes all stop accepting that URL.

Desktop public access

A share URL must be reachable by the recipient. Docker/server installations use their configured public Alex origin. In the desktop app, enable Public Access (Relay) under Admin → Users to get an HTTPS *.alexreader.app address without router port forwarding.

The relay exposes your Alex server, but it does not bypass application authentication. The generated /shared/<token> path is public; other library pages at the relay hostname still require an Alex login.

Security model

  • Share tokens are random UUIDv4 values.
  • Public metadata omits the collection owner's identity.
  • Every public cover and file request validates both the token and book membership.
  • Revocation clears the token; re-sharing produces a different one.
  • Treat the full URL as a secret. Anyone who receives or forwards it has the same collection access.