How widget access works

The widget is invisible by default

The script tag is on every page of the site, but the widget renders for nobody until it recognises the person looking at it. A customer browsing your client's shop sees nothing at all: no button, no badge, no prompt asking for an email address.

This is the core difference from a public feedback tool. You are running a review round with named people, not collecting opinions from the internet, so everyone who sees the widget got there through a link you chose to share: a personal invite, or the project's review link.

How someone gets access

When you invite a client or a member, they receive an email containing a link to the website with an access code attached. Opening it once does three things: the widget exchanges the code for a private access token, stores that token in the browser, and removes the code from the address bar so it cannot leak through a shared link or a referrer header.

From then on, the widget simply appears whenever that person visits the site in that browser. There is nothing to install, no account to create, and no password.

The review link: guest access without invites

Every project also has a shareable review link, found in the project's settings. It points at a page we host: the guest enters their name and email there, and is then taken to your site with the widget active. No invite, no waiting for an email to arrive: paste it into a chat, a ticket, or a kickoff email and the whole stakeholder group can start pinning feedback. And because the link goes through us, a guest on a link that isn't ready yet sees a clear explanation instead of a dead page. How guests differ from invited clients is covered in Roles, plans, and sharing.

The name and email a guest enters is how their feedback is labelled and where reply notifications go. The link itself is permanent: it never expires and never changes, so the copy in your client's bookmarks keeps working for round two.

When a review round is over, you can pause review feedback from the same settings card. Paused guests still see the widget and every existing thread, but new pins and replies are blocked with a clear notice until you resume. Invited clients and your own team are never affected by the pause.

Access is per device, on purpose

The token lives in the browser that opened the link. Someone who opens their invite on a laptop and later visits the site on their phone will not see the widget on the phone until they open the link there too.

The same invite link works on as many devices as they like, so the fix is usually just forwarding the original email to themselves. We chose per-device tokens over accounts because it keeps clients out of password resets entirely, which is the part of client onboarding that actually costs you time.

When someone loses access

Anyone who has lost their link can recover it themselves at vibe-vaults.com/access. They enter the email address you invited, and they receive fresh links for every project they have access to.

The page always shows the same confirmation whether or not the address is on file, so it cannot be used to discover who your clients are. It is rate limited as well, which is worth knowing if you are testing it repeatedly and stop receiving mail for a few minutes.

You can also fix it from your side, without involving them:

• Re-send the invite from the Users page.
• For yourself or a team member, use Activate widget in the project's embed card, which issues a new link for the browser you are in.

Removing access

Deleting a client's invite removes their widget access on every device immediately. Removing a member from a workspace does the same for that workspace's projects. There is no waiting period and no lingering session: the next time their widget calls us, it is turned away, hides itself, and clears the stored token.

This matters at the end of an engagement. When a project wraps and you remove the client, they stop being able to file feedback on the live site that same minute.

One more reason the widget can vanish

The widget is disabled on every project belonging to an account whose trial has ended without a subscription. Your clients are not told why; the widget simply stops appearing. If a client reports that the widget disappeared for everyone at once, check your billing status first.