Parameter share links

Parameter share links give a time-limited link to one config entry. A link can be editable or view-only, expires automatically, and can be revoked before it expires.

Use them when a teammate needs temporary access to one parameter without granting project access.

Create a link in the admin UI

Open a project.
Open the parameter table for an environment.
Use the share action on the parameter row.
Choose an expiration and permission.
Copy the generated /share/{token} link.

Supported expirations:

1h
1d
3d
30d
12m

Choose the shortest lifetime that still fits the task. In most cases, short-lived links are safer than leaving long-running access around.

The admin dialog also lets you generate a new link, copy the generated URL, review existing links for that parameter, and revoke an active link.

Create a link with the CLI

nona entries share create \
  --project storefront \
  --environment production \
  --key Features:Checkout \
  --expiration 1h

Create a view-only link:

nona entries share create \
  --project storefront \
  --environment production \
  --key Features:Checkout \
  --expiration 3d \
  --view-only

The CLI prints the token and browser link. If the public admin app is not hosted on the same origin as the API URL, pass the browser origin:

nona entries share create \
  --project storefront \
  --environment production \
  --key Features:Checkout \
  --share-base-url https://admin.nona.example.com

If you already saved the default project with nona config set project storefront, you can omit --project.

Manage existing links

List links for a parameter:

nona entries share list \
  --project storefront \
  --environment production \
  --key Features:Checkout

Admin API list responses include each link token, so the admin UI can copy existing links.

Revoke a link:

nona entries share revoke \
  --project storefront \
  --environment production \
  --key Features:Checkout \
  --id 11

In admin, revocation is handled from the same share dialog that lists the existing links.

Good use cases

Parameter share links are useful when:

one teammate needs to review a single value
someone outside the usual operator group needs temporary visibility
an incident requires fast collaboration on one parameter
editable access should be limited to one entry instead of a whole project

Good operating pattern

Use share links when the access need is narrow, temporary, and tied to one parameter. Use normal user or project access when the person needs ongoing access to a broader part of the system.

HTTP endpoints

Admin endpoints require an admin bearer token:

GET /admin/projects/{projectId}/environments/{environmentName}/config-entries/{key}/share-links
POST /admin/projects/{projectId}/environments/{environmentName}/config-entries/{key}/share-links
DELETE /admin/projects/{projectId}/environments/{environmentName}/config-entries/{key}/share-links/{shareLinkId}

Public shared-parameter endpoints use the generated token:

GET /public/share-links/{token}
PUT /public/share-links/{token}

PUT only succeeds for links created with edit permission.

Security notes

Nona stores the share-link token itself and returns it to authorized admin list requests.
Treat share-link tokens as secrets. Anyone with the token can use the public endpoint until the link expires or is revoked.
Expired or revoked links cannot read or update the parameter.
Link creation and revocation are written to the audit log.

Practical safety rules

prefer short expirations by default
use view-only links unless edit access is actually needed
revoke the link once the task is done
avoid sharing long-lived links in permanent chat history or documentation

FAQ

They provide narrow, temporary access to one parameter instead of broader ongoing project access.

Should I prefer view-only links by default?

Yes.

Use view-only unless the other person truly needs edit access to that one parameter.

Yes.

Anyone with the token can use the public share-link endpoint until the link expires or is revoked, so treat the token as a secret.

Use a share link when the access need is temporary, narrow, and limited to one parameter. Use normal user or project access for ongoing collaboration.