Why a link beats the attachment
An attachment is a copy that leaves your control the moment it sends. A link is one address you keep writing to. If the client comes back with a correction, you fix the page and the URL you already sent now shows the fix — you are not chasing "please ignore v2, here is v3".
Publish the report
Anonymous, no account, straight from the shell that rendered it:
curl -X POST https://read.botook.ai/sites \
-H "Authorization: Bearer otr_live_YOUR_KEY" \
-F file=@index.htmlThe response carries a 22-character token in the URL. That token is the credential — nobody guesses it, and it is never indexed.
Gate it to the client, not the internet
Client work usually deserves one lock. Pick the one that fits:
set_password— a shared secret you say on the call.set_email_gate— a one-time code to the client's work address, so only that domain gets in.set_expiry— the link stops resolving after the engagement, on its own.
Step by step
- Render the report to a single self-contained HTML file.
- Publish it — the command above, or
publish_htmlover MCP. - Add a gate if the numbers are sensitive.
- Point a custom domain at it so the link reads as your firm.
- Send the URL. When they ask for a change,
update_sitekeeps the same address. - Check whether they read it — dwell and read-to-end, no tracking pixels.
What the client sees
| Attachment | This link | |
|---|---|---|
| To open | Download, then find a viewer | Click, it renders in the browser |
| On mobile | Often blocked or broken | Same page, responsive |
| A correction | Resend the whole file | Same URL, new bytes |
| Did they read it | No way to know | Dwell + read-to-end, if you want it |
Can I stop the link working after the project ends?
Yes — set_expiry with a date, or expires_in_hours at publish. After that the
page returns 410, then 404 once it is purged.
Does the client need any account?
No. A browser is the whole requirement. The email gate, if you use it, sends a code — it does not create a login.
Is the report indexed or public?
Neither. Every page carries noindex and an unguessable token; the link is the only
way in, and it is never listed.