Verify Document Recipients and Review Viewing Activity

Password, verified email, or both

Suppose that you are about to send a proposal, an investor update or an AI-generated report. You want two things. Only the right people get in, and you can see who opened the document. People often mix up three controls:

Control	What it proves	What it does not prove
Shared password	The visitor knows the password	Who the visitor is. Anyone who receives the password also gets in
Email typed into a form	Someone typed an address	That the visitor owns that address
Verified email (one-time code or link)	The visitor had access to mail at that address at sign-in	That they read the whole document

A shared password is fine for a small review group if you do not need names. If you want to connect activity to a person, you need verification. In verification, the service sends a code or a link to the address. The visitor then proves that they received it. Use verification together with an allow list (a list of named addresses or domains that can enter). Without an allow list, some services let in any verified address.

Choose the tool for the type of content that you share. For a website or a multi-page HTML report, host it on Cloudflare Pages. Put Cloudflare Access with an email one-time PIN (a single-use code sent by email) in front of it. For a PDF, a deck or a single document, use a document-sharing service such as Papermark or DocSend. These services verify the email and record views per document.

Option 1: gate a report site with Cloudflare Access

Cloudflare Access sits in front of the site as a gate (a sign-in step before any content). It checks the identity of each visitor before it serves any file. With the one-time PIN method, visitors type their email, receive a code and paste the code. They do not need a Cloudflare account.

1. Deploy the files. In the Cloudflare dashboard, open Workers & Pages. Select Create application, then Get started and Drag and drop your files. Give the project a name. Upload the folder that contains index.html. From a terminal, npx wrangler pages deploy <folder> does the same (Direct Upload docs). Our Cloudflare Pages publishing guide shows this step in detail.
2. Turn on one-time PIN. Go to Zero Trust > Integrations > Identity providers. Select Add new identity provider. Choose One-time PIN (one-time PIN docs).
3. Protect every hostname. In the Pages project, Settings > General > Enable access policy protects only the preview deployments. The production <project>.pages.dev address and any custom domain need extra steps. Cloudflare lists these steps on its Pages known issues page. Our Cloudflare Pages Access guide explains them.
4. Write the policy. By default, Access denies everyone. Add an Allow policy. Under Include, use Emails for named people (anna@client.com). For a whole company, use Emails ending in (@client.com). To block one address inside an allowed domain, add an Exclude rule (policy docs).
5. Set the session duration on the application. When the session expires, visitors must request a new code.

Know these behaviors before you send the link:

• The PIN expires 10 minutes after the request, and it works only once. A request for a new code cancels the old code.
• A blocked address receives no email, but the screen still says “A code has been emailed to you”. So visitors without approval cannot use the screen to find out which addresses are allowed.
• Corporate mail filters and link scanners can use up codes. If a recipient sees “This One-Time PIN has already been used”, the recipient must select Request new code. Their IT team can add noreply@notify.cloudflare.com to an allow list.

See who signed in and which pages got views

Cloudflare gives you two separate records.

The first record shows who signed in. In the Zero Trust dashboard, open Logs. Select Access authentication logs (log docs).

Each entry shows the user email, the application, the time, the IP address and the country. It also shows if Access allowed or denied the visit. An event appears only after the visitor submits a code. The log does not show a person who typed an address and then stopped.

The second record shows what visitors viewed. In the Pages project, open Metrics. Under Web Analytics, select Enable. Cloudflare adds its script on the next deployment (setup docs). You get page views and visits. You can filter them by Path, Referer, Country and Device type (dimension list).

Web Analytics does not collect the personal data of visitors. So it never links a page view to an email. Read the two records together. For example, the log says “anna@client.com signed in on Tuesday at 10:14”. Web Analytics says “the pricing page had views on Tuesday”. If you must know exactly which pages one person read, use a document tool instead.

Option 2: share a PDF or deck with Papermark or DocSend

Document-sharing services verify each viewer and track reading per document.

In Papermark, upload the file. Create a link. Open the settings of the link. A link can combine these options (link settings reference):

• With Password, viewers must enter a password.
• With Email protection, viewers must type an email before they can view.
• With Email verification, viewers confirm their address with a one-time code. Papermark calls this option stronger than email protection.
• With Allow list / deny list, you set the emails or @domains that can or cannot view.
• Allow download is off by default, so the file is view-only.
• With Expiration, the link stops working after a date that you set.

Turn on email verification. Add the allow list. If the client also asked for a password, set a password on the same link. Before you send the link, look at the prompt in the preview (eye icon) (email verification steps). Papermark’s page-by-page analytics show the time spent on each page and when someone last viewed the document.

In DocSend, open Permissions in a Space. Turn on Require email. Select Verify email. For a single file, choose Create link and Require an email to view. You can also add a password.

The visitor gets a verification link that is valid for up to one hour. The visitor must open the link on the same device that they used to open the document. Verified visitors get a badge on the document details page, in visit notification emails and on the dashboard. DocSend lists this feature for its Advanced, Advanced Data Rooms and Enterprise plans (DocSend email authentication).

Test the gate before you send it

Sign out of every account. Then do these checks in a private browser window:

1. Open the link. The login or verification screen must appear before any content.
2. Sign in with an allowed address. Make sure that the code arrives and that the content opens.
3. Try an address that is not on the list. It must not get in.
4. Paste a direct file URL, such as /files/report.pdf or an image path. It must ask for the same login.
5. Test every address that serves the content: production, previews and any custom domain.
6. Open the activity view. Make sure that your test visit appears.

Read the activity with care

A sign-in tells you that someone with access to that inbox entered a code. A shared address such as team@client.com can cover five people. A view of the first page does not mean that the person read the whole document. These records also do not show consent or approval. Get decisions in writing.

No activity is not the same as no interest. Before you decide that the recipient ignored the link, ask three questions. Did the code arrive? Did a mail filter hold it? Was the recipient able to pass the gate?

After someone opens the document, follow up with a specific question about the section that they viewed. Our guide to following up after a client opens a shared document has message examples.

In your message, tell recipients that the link records sign-ins and views. Then the follow-up does not come as a surprise.

A docs portal with Ask AI
and support tickets

Connect a repository, or describe your product to start. Each docs site has search, Ask AI, an API console, an MCP server and support tickets.

• Publishes from GitHub on every push
• Works with Mintlify repositories
• API console from your OpenAPI file
• MCP server and llms.txt for AI agents
• Ask AI and support tickets
• Analytics for people and AI agents

Start Free→ Questions? Ask AI in our docs

No card required.