Every document in Docutrain carries exactly one access level. You set it in the document editor on the Settings tab, under Access, and it decides who can open the chat page. The check happens on Docutrain's servers for every request — loading the document, sending a chat message, fetching references — so it cannot be worked around from the browser. The page never contains the passcode itself; it only signals that one is required.
The six levels
| Access level | Who can open the document | Sign-in required |
|---|---|---|
| Public | Anyone with the link. | No |
| Passcode | Anyone who enters the document's passcode. | No |
| Token link | Anyone holding a valid token link for the document. | No |
| Registered | Any signed-in user. | Yes |
| Owner group | Signed-in members of the document's organization, and its admins. | Yes |
| Owner admins only | Signed-in administrators of the document's organization. | Yes |
Three caveats sit around that table. Public and Passcode are paid-plan features; on plans without public sharing their tiles show a lock icon and selecting one opens an upgrade prompt instead of changing the setting. Owner group and Owner admins only need the document assigned to an organization first — until then they are disabled behind an Owner required notice. Super admins can open any document regardless of level.
The two organization-scoped levels are what most teams reach for when content is internal. Owner group is readable by everyone connected to the document's organization plus its admins. Owner admins only narrows that to administrators, which makes it a reasonable home for drafts. Membership in an organization is granted by invitation or by an admin's assignment; see users, roles and invitations.
Passcodes and token links
Selecting Passcode reveals a passcode field directly in the tile. Anyone with the link is prompted once, and after a correct entry the passcode is remembered on that device for about three months, so returning readers are not asked again. Changing the passcode locks out everyone who only knows the old one — they get prompted again on their next visit. That is the cheapest way to revoke a passcode, and it is also its main limitation: you revoke everybody at once.
Token links are the per-recipient alternative. Selecting Token link opens the token manager below the tiles. The document has to be saved first, which is why the access-level chooser shown before an upload starts offers every level except Token link — tokens are issued against a saved document, so you switch to it in the editor once training finishes.
Each token you create with New token takes three optional fields: a Name for your own reference ("Conference attendees"), an Expires date and time, and a Max uses count. Leave expiry or the use limit empty for none. Per token you can copy the full share link — the token is part of the link, so recipients never type anything — edit its name, expiry and limit, switch it between Active and Inactive, or delete it. The list shows each token's status (Expired, Maxed out, Inactive) along with uses remaining and uses so far.
A use is counted when someone arrives through the link. After that the token is remembered for their browsing session, so moving between pages or coming back in the same session does not burn another use. Signed-in members of the organization do not consume uses at all.
What a reader sees when they are turned away
The message depends on why access was refused.
| Situation | What the reader sees |
|---|---|
| Passcode document, no passcode entered yet | A Passcode Required screen with your organization's logo and an entry field. A wrong entry shows "Incorrect passcode. Please try again." |
| Token-gated document opened without a token link | An Access Token Required screen. There is nothing to type — they need the proper link. |
| Sign-in required and the reader is signed out | The sign-in page, then back to the document once signed in. |
| Signed in but not permitted — not a member of the organization, say | An access denied message explaining they lack permission. |
| Collection requires a passcode | A Passcode Required screen for the collection; one passcode unlocks everything inside. |
| Collection requires a token and none was supplied | An Access Token Required page, with "Invalid or expired token" when a bad token was used. |
Paused documents, offline collections, and the disclaimer gate
Access levels are not the only thing standing between a reader and your content. Document status on the Overview tab (the same switch as Active document on Settings) takes a document out of circulation entirely — useful for drafts, and reversible. Inside a collection, a paused document stays a member and stays ticked in the editor, marked Paused, but is not served to readers and is left out of collection-wide chat until you reactivate it.
Collections have the same switch at their own level. Turning off Active collection routes visitors who follow the link to the Start page with a Collection Offline notice: "This collection has been temporarily disabled. Please try a different collection or contact the administrator." That happens before any passcode or token check, and it also takes down the collection's shared-conversation links and its contact form.
Disclaimers are a different kind of gate — they do not restrict who may enter, only what they must agree to first. Show disclaimer modal in a document's Messages tab makes readers accept before they can use the document, with I agree / I decline buttons and links to the Terms of Service and Privacy Policy. A collection can replace the per-document versions with one collection-wide disclaimer covering chat across all documents; a reader who declines is returned to the collection page with a notice that they must accept before viewing documents or chatting.
Where the rules travel
A collection's gate takes precedence inside the collection. Anyone who can open the collection can open every document in it, including documents whose own level is stricter. That is deliberate, and the collection editor warns you when you bundle protected documents, with a confirmation dialog on save. Outside the collection each document's own level still applies. Signed-in members of the collection's organization skip its passcode and token gate entirely, and their visits do not consume token uses — though a document's own passcode still applies when that document is opened on its own.
Embeds inherit the document's rules rather than escaping them. A passcode-protected document asks for its passcode inside the embed, and the entry is remembered on the reader's device where the browser allows it. The Embed & Share tab warns you directly: if the document is not Public, visitors using those share and embed methods will hit a login wall, passcode prompt, or access restriction. See embedding on your website.
Shared conversations behave the same way. A recipient still has to pass the document's gate, so sharing a chat never exposes protected content to someone who could not open it directly. Where the thread cannot be continued — the document was deleted, or access was withdrawn — the conversation is still shown in full, read-only, above a short amber note explaining why. More on that in sharing and exporting answers.
Finally, being reachable is not the same as being findable. Discoverable in search lets a document appear in Docutrain's own search results, but only when its level is Public and the toggle is on. Include in sitemap, offered for public documents, hands it to external search engines. Turn both off and a public document stays unlisted: open to anyone with the link, promoted nowhere.
Start with the least permissive level that works and widen when you have to. To hand access to named people and take it back later, use token links rather than a shared passcode.