Why the attachment fails
- Many mail systems quarantine HTML attachments outright — it is a common malware shape.
- On a phone the file usually downloads and then nothing opens it.
- Relative assets break the moment the file leaves your machine.
- You cannot revoke it, correct it, or know whether it was opened.
The replacement
curl -X POST https://read.botook.ai/sites \
-H "Authorization: Bearer otr_live_YOUR_KEY" \
-F file=@report.htmlSend the URL. Their browser renders the page; there is no download and no login.
No key, no account
curl -X POST https://read.botook.ai/v1/publish -F file=@index.htmlThe anonymous link lives 24 hours. Claim it afterwards if it turns out to matter.
Files that are not one HTML file
| What you have | What to do |
|---|---|
| A markdown document | Publish it directly — it is rendered when stored, not when read. |
| An SVG diagram | Published as-is and served as an image. |
| A folder with assets | Zip it; the tree is served with index.html as the entry. |
| A PDF | Wrong tool — this hosts web pages. |
Put a passcode on it
set_password({ site_id: "…", password: "hunter2" })Send the passcode through whatever channel you already use with them — not in the same email as the link, or you have one gate rather than two.
Set an expiry that matches the work
A quote is stale in a month; a handover is stale in a day. Expiry here is deletion, so a link that has passed its date has nothing behind it:
set_expiry({ site_id: "…", expires_in_hours: 720 })Revoke it
Sent the wrong thing? Delete the page and the link stops working immediately — the one capability an attachment can never have:
curl -X DELETE https://read.botook.ai/sites/SITE_ID \
-H "Authorization: Bearer otr_live_YOUR_KEY"Fix it instead
Usually better than revoking: replace the content in place. The link in their inbox now shows the corrected version, and nobody has to be told there was a version one.
Know it arrived
Opens and unique viewers per page, in the dashboard or over the API. A follow-up is easier to word when you know whether they have looked.
What the recipient does
- Clicks the link.
- Types the passcode, if you set one.
- Reads the page.
That is the entire experience. No account, no login, no install, no browser extension.
Send it in a chat instead
The same link drops into a Slack thread and unfurls to a preview image, which is a great deal more useful than an attachment rendered as a code block — the Slack version.
Multiple recipients
One share token per recipient means you can revoke one without disturbing the others, and the counters tell you who is actually reading.
What the client has to do
Nothing, and that is the whole argument. No account, no download, no "open this in Chrome, it looks broken in Preview", no plugin, no shared drive invitation that needs their IT to approve it. They click a link and read the thing you sent. Every step you remove between the send and the read is a step where the work could have stalled for two days.
When the file is not one file
Reports rarely arrive as a single self-contained document. A build directory with images and a stylesheet goes across as one archive and is unpacked into a tree, with relative links between the files intact:
cd report && zip -r ../report.zip . && cd ..
curl -X POST https://read.botook.ai/sites \
-H "Authorization: Bearer otr_live_YOUR_KEY" \
-F file=@report.zipThe entry point is index.html. If the archive has no index.html, that
is the one thing to fix before sending — the reader has no file browser, only a link.
Checking it before it goes out
The failure that stings is sending a link to a client and hearing that the page is blank. Fetch your own link once before you send it, from outside whatever session produced it:
curl -s https://read.botook.ai/p/UNLISTED_TOKEN/ | head -c 300A 201 from the publish call means the bytes were accepted; it says nothing about
whether the markdown rendered or the archive had a usable entry point. Thirty seconds of looking is
the difference between a delivery and an apology.
It also fixes your archive
Instead of eleven copies of report-final-v3-REALLY-final.html in a mailbox, there
is one page whose current version is authoritative — and that is what everyone holding the link
sees.
Questions
Can they download the page?
Yes, as with any web page. Access control is about who gets in, not about what a legitimate reader keeps.
Is it indexed?
No. Every response carries noindex and there is no listing.
Does it work on a phone?
Any browser. That is the whole advantage over the attachment.
What does it cost?
Nothing — pricing.