How widget access works

The widget is invisible by default

The script tag is on every page of the site, but the widget renders for nobody until it recognises the person looking at it. A customer browsing your client's shop sees nothing at all: no button, no badge, no prompt asking for an email address.

This is the core difference from a public feedback tool. You are running a review round with named people, not collecting opinions from the internet, so access is by invitation only.

How someone gets access

When you invite a client or a member, they receive an email containing a link to the website with an access code attached. Opening it once does three things: the widget exchanges the code for a private access token, stores that token in the browser, and removes the code from the address bar so it cannot leak through a shared link or a referrer header.

From then on, the widget simply appears whenever that person visits the site in that browser. There is nothing to install, no account to create, and no password.

Access is per device, on purpose

The token lives in the browser that opened the link. Someone who opens their invite on a laptop and later visits the site on their phone will not see the widget on the phone until they open the link there too.

The same invite link works on as many devices as they like, so the fix is usually just forwarding the original email to themselves. We chose per-device tokens over accounts because it keeps clients out of password resets entirely, which is the part of client onboarding that actually costs you time.

When someone loses access

Anyone who has lost their link can recover it themselves at vibe-vaults.com/access. They enter the email address you invited, and they receive fresh links for every project they have access to.

The page always shows the same confirmation whether or not the address is on file, so it cannot be used to discover who your clients are. It is rate limited as well, which is worth knowing if you are testing it repeatedly and stop receiving mail for a few minutes.

You can also fix it from your side, without involving them:

• Re-send the invite from the Users page.
• For yourself or a team member, use Open widget on site in the project's embed card, which issues a new link for the browser you are in.

Removing access

Deleting a client's invite removes their widget access on every device immediately. Removing a member from a workspace does the same for that workspace's projects. There is no waiting period and no lingering session: the next time their widget calls us, it is turned away, hides itself, and clears the stored token.

This matters at the end of an engagement. When a project wraps and you remove the client, they stop being able to file feedback on the live site that same minute.

One more reason the widget can vanish

The widget is disabled on every project belonging to an account whose trial has ended without a subscription. Your clients are not told why; the widget simply stops appearing. If a client reports that the widget disappeared for everyone at once, check your billing status first.