# Sharing: with your team and externally via link

{/* AUTO-SYNCED SOURCE: this page lives in apps/app/src/modules/credentials/docs/ and is mirrored into the docs app by `bun sync:module-docs`. Edit it in the module, not in apps/docs. */}
<Lead>
An entry in the credentials vault (Zugangsdaten-Tresor) only becomes useful when exactly the right people can see it: your team through internal shares, outside partners through a time-limited link. You control both per entry, and both are logged.
</Lead>

## Personal or shared

Every entry has a **visibility** that you set when creating it (and can change later while editing):

<DefinitionList>
  <DefItem term="Geteilt (Team) / shared">
    The entry belongs to the team. Who can see it depends on permissions and shares: admins see all shared entries, members see their own entries plus everything shared with them.
  </DefItem>
  <DefItem term="Persönlich / personal">
    The entry belongs to you alone. Nobody else sees it, admins included. The only technical exception is the workspace owner. In the list the entry carries the badge **Persönlich**.
  </DefItem>
</DefinitionList>

## Sharing with the team

The row action **Teilen** (share) opens the sharing dialog. There you grant **read access** through three kinds of toggles:

- **per member:** unlock individual colleagues one by one
- **per role:** all **Administrator:innen** (admins), **Mitglieder** (members) or **Betrachter:innen** (viewers) at once
- **per group:** your own team bundles (see below)

Two rules always apply:

- Shares grant **read access**: recipients can see and reveal the entry, but not edit or delete it.
- The **creator always keeps management access** to their own entry. In the dialog this person is marked **(Ersteller)** (creator), and their access cannot be revoked.

<Info title="A share is not the same as vault access">
A share only takes effect for people who are allowed to open the vault in the first place. Whether a role may do that is controlled by the workspace's tool permissions: see [Audit and permissions](/tools/zugangsdaten-tresor/audit-und-berechtigungen#roles-and-permissions).
</Info>

## Groups

If you keep unlocking the same circle of people (for example "everyone handling portals"), a group pays off. The header button **Gruppen** (groups) opens the **Permission-Gruppen** dialog, which the vault describes as **Team-Bündel für Freigaben** (team bundles for shares):

- **Create:** enter a name (the field suggests **Neue Gruppe (z.B. Portale)**, new group, e.g. portals) and pick the members via checkboxes.
- **Use:** when sharing an entry, the group appears as its own toggle.
- **Delete:** when removing a group the dialog warns: **Bestehende Freigaben an diese Gruppe entfallen.** (existing shares to this group are dropped).

Only people with the matching permission can manage groups (admins by default).

## External sharing via link

For outside partners without a platform account (notary office, property management, IT service provider) you create a time-limited share link in the sharing dialog under **Extern per Link** (externally via link):

<Steps>
  <Step title="Set the scope">
    Optionally enter the recipient's address under **E-Mail (optional)** (for your own bookkeeping). Under **Gültig für** (valid for) pick the lifetime: **1 Stunde** (1 hour), **6 Stunden** (6 hours), **24 Stunden (Standard)** (24 hours, default), **3 Tage** (3 days) or **7 Tage (max)** (7 days, maximum).
  </Step>
  <Step title="State a reason">
    The field **Grund (Pflicht, protokolliert)** (reason, required, logged) is mandatory. The reason goes into the audit log so your team can later reconstruct why this login left the house.
  </Step>
  <Step title="Create the link and send it yourself">
    After **Link erzeugen** (create link) the vault shows you the link **exactly once**, with a note to copy it and send it yourself. The platform sends **no** email. Copy the link and deliver it through a channel of your choice.
  </Step>
</Steps>

For every active link you then see a row with the email (or "ohne E-Mail", without email), the validity and an open counter, for example **bis 24.07.2026 · 3× geöffnet** (valid until, opened 3 times). **Widerrufen** (revoke) invalidates a link immediately, at any time.

<Warning title="Limits of external links">
Entries on the **hyper-sensitive** level can never be shared externally. Also: a link is only as safe as its delivery channel. Anyone holding the link during its lifetime can open the entry; there is no email verification of the recipient. Keep the lifetime as short as possible and revoke the link as soon as it is no longer needed.
</Warning>

## The recipient view

The recipient opens the link (an address of the form `/share/{token}`) in the browser, no account needed. There they can only **view and copy** the entry; the clipboard also clears itself automatically 30 seconds after copying. The page states: **Dieser Link ist zeitlich begrenzt und kann jederzeit widerrufen werden. Jeder Zugriff wird protokolliert.** (this link is time-limited and can be revoked at any time, every access is logged). After expiry or revocation the page is no longer reachable.

## Further reading

For recurring services where each team member should deposit their **own** login, there is a better way than many individual shares: [Staff logins](/tools/zugangsdaten-tresor/mitarbeiter-zugaenge). What exactly gets logged is covered in [Audit and permissions](/tools/zugangsdaten-tresor/audit-und-berechtigungen). Back to the overview: [Credentials vault](/tools/zugangsdaten-tresor).