Public links that open exactly one door

Every Amolfi link that works without a login is minted for a single action and given the narrowest capability that finishes it. A signature link signs one document. It can’t list your other documents, open the client record sitting behind it, or wander anywhere else in the workspace. A form link submits that form, a booking link books that slot, and a portal link shows one client their own records. There’s no general public-access mode underneath any of it, so there’s nothing broader for a link to reach for.

That covers a lot of ground. A form a prospect fills in, an approval a client signs off, a contract, a booking slot, a portal a client logs into: all of them have to work for someone with no account and no password. Each one is a door cut into the wall of your workspace, and with a door, the thing that matters is how wide it opens.

Once it’s sent, it isn’t yours

Think about the last contract you sent out for signature. The second you hit send, that link stopped being yours. It sat in someone’s inbox. It probably got forwarded to a partner, and from there to whoever handles their paperwork. You have no say in where it travels. The only thing you still decide is what it’s allowed to do when it arrives.

The worst case stays the size of the link

Here’s what that buys you: a leak you can reason about ahead of time. Say that signing URL ends up three forwards deep, in an inbox you’ve never heard of. The person holding it sees a document that was meant to be signed. They don’t see your client list, your invoices, or a route into the rest of the business. With a broad access token, that forward starts an investigation and ends in a call you don’t want to make to a client. With a scoped one, the damage is bounded before it happens, and you can say precisely what the link could reach.

Nobody chooses software for the way its links behave. But those links are where the outside world reaches in and touches your data: the form on your site, the contract out for signature, the portal a client opens on a Sunday night. Building every one of them narrow is what makes them safe to send without thinking about it.