Can I switch a gated artifact to public later?

Yes. Access control is per-artifact and changeable at any time. Set it to public and the authentication requirement is removed entirely.

Does the viewer need to create an account?

No. Viewers authenticate with their existing company Google or Microsoft account, the same one they use for email. On the Free plan they get a one-time password (a six-digit code by email) instead. No new account, no new password.

Is gated publishing slower than public hosting?

No meaningful difference for viewers. Authentication adds one redirect the first time (a few seconds, done once). After that, subsequent visits use a session cookie, with no re-authentication.

Is a long random URL good enough for internal content?

No. An unguessable public URL is still public: it can be forwarded, indexed, or leaked, and nothing records who opened it. Gated publishing ties access to identity, so leaving the company or forwarding the link doesn't grant access.

What does it cost to gate content behind company SSO?

€49/month flat on Pro, for your whole organization and unlimited viewers, with no per-seat fee. The Free plan gates up to 10 artifacts using one-time passwords.

Gated Publishing vs. Public Hosting: What's the Difference?

Public hosting and gated publishing both take a file and give you a URL. The difference is who can open that URL. Public hosting answers "everyone." Gated publishing answers "whoever you decide," and by default that's people with an email on your company domain. This page explains the distinction, when each is right, and why "just put a password on it" is a different thing from real identity-based access.

What public static hosting is

GitHub Pages, Vercel, and Netlify all work the same way: push a file, get a URL, anyone can view it. No authentication. No restrictions. The URL is public.

This is the right model for a lot of things: open source documentation, public marketing sites, personal portfolios, API references meant for the world to read. If the audience is "everyone," public hosting is correct and usually free.

What gated publishing is

Gated publishing is the same idea (push a file, get a URL), but the URL is behind a gate. Access is controlled by company identity. Viewers authenticate with their Google Workspace or Microsoft 365 account. If the email domain matches, they're in. If it doesn't, they're blocked.

The result: a URL that renders the full interactive page for anyone inside the company, and returns an authentication error for anyone outside. The URL never changes, so it keeps working in Slack threads and Notion pages for months. For the full definition, see what is gated publishing.

When you need each

Use case	Public hosting	Gated publishing
Open source documentation	✅	–
Public marketing site	✅	–
Personal portfolio	✅	–
Architecture proposal	–	✅
Internal competitive analysis	–	✅
AI-generated presentation	–	✅
Agent-authored research dossier	–	✅
Internal API docs (Swagger UI)	–	✅
Client-facing demo (public)	✅	–
Client-facing demo (confidential)	–	✅

The decision rule: if any part of the audience shouldn't see the content, you need gated publishing. If the entire world can see it, public hosting is fine.

Why "just hide the URL" doesn't count

A common half-measure is public hosting with a long, random, hard-to-guess URL. That's security through obscurity, and it's explicitly not access control: the URL is still public, so anyone it's forwarded to can open it, search crawlers can index it, and there's no record of who looked. Guidance like the OWASP Application Security Verification Standard treats access control as an explicit requirement, not a property of an unguessable link. For internal architecture, financials, or client work, an unlisted public URL fails the moment it leaves the intended chat.

Can't you just use Vercel with a password?

Vercel offers two auth options above the free tier (Vercel pricing):

Password protection (Pro add-on): A shared password. Not identity-aware. Anyone who knows the password can view, including people who've left the company, contractors whose access should have been revoked, and anyone the original viewer forwarded the password to. No per-user audit trail. No domain restriction.

SAML SSO (gated behind Vercel's enterprise/advanced tiers): Identity-aware, real authentication. But Vercel prices SSO for a single, long-lived application deployment. It doesn't fit ad-hoc artifact sharing where you might publish dozens of files a month.

display.dev includes Google and Microsoft SSO at €49/month flat, for your entire organization, all artifacts, unlimited viewers. See the full breakdown in gated publishing vs. file sharing and the password-protect-an-HTML-file comparison.

Identity-based auth vs. a shared password

	Shared password	Identity-based (SSO / OTP)
Tied to a person	❌ (anyone with the string)	✅ (their company account)
Revoked when they leave	❌	✅ (offboard once, everywhere)
Per-viewer audit trail	❌	✅ (Pro: 90-day audit logs)
Survives forwarding	❌ (the point)	✅ (a new person must still authenticate)
Setup for viewers	Share the password	Click sign-in with an account they already have

A majority of professional developers now use AI coding tools (Stack Overflow 2025 Developer Survey), which means the volume of internal HTML that needs gating (not publishing to the open web) is only growing.

The gate is a capability, not a restriction

Gated publishing doesn't mean "always private." You can make any artifact public: the gate is something you control. An artifact set to public mode is accessible to anyone with the URL, no authentication required, exactly like public hosting.

The difference is that access control is a first-class feature. You decide, per artifact, who can see it. Public hosting has one access level: everyone. Gated publishing has more: authenticated organization members, specific invited people, or everyone, and you can change it any time.