# Sharing reports

> Read-only links, invitations, asking an owner, pull request notes, the README badge, Slack and API keys.

There are three ways to give someone the numbers without giving them the buttons.

| | Who it is for | Sign-in | Lasts |
| --- | --- | --- | --- |
| Read-only link | Finance, a board pack, anyone outside the company | Not needed | 30 days |
| Viewer role | Colleagues who should see every page | Your [single sign-on](/docs/sso) | Until removed |
| API key | Scripts, warehouses and coding agents | Bearer key | Until revoked |

## Read-only links

**Settings → Create a link** gives a URL that opens the latest report read-only, without an account. Buttons, checkboxes and the change log are not shown.

```text
https://opsen.dev/r/<token>
```

| | |
| --- | --- |
| Lifetime | 30 days from creation |
| Shows | The latest completed report, at the time it is opened |
| Revoke | **Settings → Revoke every link** invalidates every link issued so far |
| As JSON | Append `.json`. See [Report JSON](/docs/report-json) |

A link is signed, not stored: it names the workspace and a revocation counter, so revoking works by moving the counter on. Uninstalling the app also disables every link. Creating, revoking and opening links are in the [audit log](/docs/audit-log).

## Inviting people

**Settings → People with access → Invite.** Enter an email address and a role. opsen emails an invitation; the person signs in with that address (a code by email, or Google, GitLab, Microsoft or GitHub on the same verified address) and lands in the workspace. Invitations work for thirty days and can be cancelled until accepted. Only owners invite, change roles and remove people.

| Role | Can |
| --- | --- |
| Owner | Everything, including single sign-on, people and billing |
| Admin | Act on findings, connect platforms, set prices and budgets, create API keys |
| Viewer | Read every page and export CSV; change nothing |

People who sign in through your identity provider get the role you choose for it. See [Single sign-on](/docs/sso#roles).

## Asking an owner

Only an organisation owner can install a GitHub App. If you are not one, open [opsen.dev/ask](/ask), enter the organisation, and send the message opsen writes to an owner. Its link explains opsen to them and starts the install. When they finish, opsen asks them whether to let you in, as a viewer or an admin, and emails you once they do. Nobody gets access without an owner choosing it.

## Notes on merged pull requests

**Settings → Sharing → Note on merged pull requests.** When a pull request merges, opsen adds one comment with the workflow runs it triggered, the runner minutes they used and what that cost at your prices. It is off until an owner or admin turns it on, and needs the *Pull requests* event enabled on the GitHub App. Comments are written by the app, never by a person.

## README badge

**Settings → Sharing → README badge** shows a badge with what opsen saves you each month, and the Markdown to paste into a README. The badge URL carries a token, so it only works for the workspace that made it, and only while the setting is on. It shows the figure and nothing else.

## Slack

**Settings → Sharing → Slack, weekly.** Paste a Slack [incoming webhook](https://api.slack.com/messaging/webhooks) URL. opsen posts a test message to check it, then each Monday posts what is paid for and not used, what has been saved and the three largest findings. The URL is stored encrypted like any other credential. Disconnect it from the same place.

## Referrals

Your [account page](/account) has a referral link. When an organisation that installed through it pays its first month, both sides get fee credit, applied automatically when a month is billed. Credit is not paid for organisations you are already in.

## API keys

**Settings → API keys and MCP** creates a key that reads one workspace's latest audit. See [MCP, plugins and API](/docs/mcp).