Viewers and sign-in
A viewer is a person given access to a preview. Viewers have no Houseguest™ account: their email address is their identity, and a 6-digit code sent to it is the proof. What they see is described in What viewers see.
Invites
Section titled “Invites”Each invite is a single-use link for one address, valid until the preview ends (at most 7 days).
- Invite on the preview: one or more addresses, one per line, and an optional message. Send invites emails each person their link; Create links only sends no email and shows each link once, with Copy, for you to send in Slack, Teams or a message. It is the same single-use link the email would carry.
- New link next to a pending invite (one not used yet) makes a new link for that person and shows it once. The link they have stops working. Use it when the first link went to the wrong place or was never sent. The activity log records “Created an invite link” or “Created a new invite link” for links you send yourself, and “Invited” for emailed ones.
- Opening the link shows a confirmation page first, so link previewers in chat and mail cannot use it up.
- With Email code on (the default), the viewer presses Email me a code and enters the code, so a forwarded link is useless without the invited inbox. With it off, the link alone opens the preview once.
- After that, the invite works in that one browser until the preview ends. Another browser or device needs a new invite.
Standing access
Section titled “Standing access”One link, the app’s own address, for everyone on the list.
- Entries are exact addresses (
alex@customer.com) or whole domains (@customer.com). - Add people on the preview, or Standing access → Edit list. Tick Email them the link to send each
added exact address the link. An
@domainentry gets no email. - A viewer enters their address on the sign-in page and gets a code if the list covers it. The page answers every address the same way, so it never reveals who is on the list.
- Sign in with Microsoft stands in for the code, on standing access and on invites with email codes: the Microsoft account’s confirmed address must be on the list, or be the invited address. Nothing else changes: the list, the session length and the people limit apply as for a code. See What viewers see.
- Viewer session length: until the preview ends, 8 hours, or 1, 7, 30 or 90 days. Then they sign in again with a new code. Changing it on the preview’s Settings applies to sign-ins from then on.
Allowed viewer domains
Section titled “Allowed viewer domains”A workspace can limit invites and list entries to certain domains (and their subdomains), in Settings › Viewers & email or on Standing access. Empty allows any address. People already invited or listed keep their access.
Email codes
Section titled “Email codes”| Rule | Value |
|---|---|
| Code | 6 digits, single use |
| Valid for | 10 minutes |
| Wrong tries | 5, then a new code is needed |
| New code | After 30 seconds; up to 5 an hour per invite or per address |
| Per network (standing access) | Up to 10 code requests an hour from one network address |
Codes and invite links are stored only as hashes.
Sessions
Section titled “Sessions”A sign-in sets a cookie scoped to the preview’s parent domain, so it covers every hostname in the preview. It is marked Secure and HttpOnly, and Houseguest removes it before the request reaches your app, so the app never sees it and its own cookies never mix with it.
A session lasts until the preview ends (invites) or for the viewer session length (standing access), capped at the preview’s end. Extending a preview keeps signed-in viewers signed in: sessions that ran to the old end move to the new one (standing access: up to the viewer session length). Revoked viewers stay out.
Revoke and remove
Section titled “Revoke and remove”- Revoke next to a viewer ends their sessions, their unused invites and their command-line sign-ins at their next request. Sending a new invite (or adding their exact address back to a list) starts fresh: only the new link or sign-in works.
- Remove next to a list entry takes it off and revokes everyone it covered who is not covered by another entry.
- Revoking someone whose
@domainis on the list shuts them out while the domain stays. To let them back, add their exact address. Adding the@domainagain does not restore people it covered before. - Open SSH and TCP connections run until they close: see TCP and SSH.
Who used it
Section titled “Who used it”The preview’s page shows:
- Viewers: each person’s state (Signed in, Invite sent for an emailed invite, Link created for a link made to copy and not emailed, Revoked, Signed out, Invite used or expired), first sign-in, last seen and request count. A viewer opens a timeline of their activity. Export downloads the list as CSV. On a phone each person is a card, with New link and Revoke under their details.
- Requests: the newest 50 requests, filtered by Viewers, Sign-in, Refused, All or Monitors. A viewer’s request count links to just their requests.
The request log keeps the time, the person, the method, the hostname, the path and the decision. Never query strings, never request or response bodies. Most refused rows are expected: a viewer’s first visit before sign-in, and app calls that carry no cookie.
Requests from uptime checkers are listed under Monitors and left out of every other filter and count. See Uptime checkers.
Limits
Section titled “Limits”A workspace’s plan sets how many people one preview can have (50 in early access). A new person past that is refused; the sign-in page says “This preview has reached the number of people it can have”. See Limits in early access.
© 2026 Houseguest Technologies LLC. Houseguest™ is its trademark.7723 Tylers Place Blvd., Box #119, West Chester, OH 45069