Give Your Client A Login That Can't Break Anything
Zippy workspaces now have a read-only seat: sees every screen and every number, changes nothing. Enforced by the API on every single request, not by graying out buttons — and here's why that distinction is the entire feature.
⚡ Zippy: "just don't touch anything" is not a permission system. it's a hope.
The screenshot treadmill
If you run links for somebody else — a client, an artist you manage, a brand you consult for — you know the two options you had, and you know they were both bad.
Option one: send screenshots. Every week, forever. They ask a question the screenshot doesn't answer, so you send another screenshot. You are a human API with a 24-hour latency.
Option two: hand over your login. Now they can see everything, which is what they wanted. They can also edit a live destination the night before a drop, delete the folder your whole campaign lives in, or "tidy up" a link that's printed on ten thousand physical flyers.
Neither of those is a product feature. They're both workarounds for a missing role.
The read-only seat
Zippy workspaces now have three roles:
| Role | Reads everything | Creates & edits | Billing, team, settings |
|---|---|---|---|
| Owner | ✅ | ✅ | ✅ |
| Teammate | ✅ | ✅ | — |
| Read-only | ✅ | — | — |
Invite one from Team: enter the email, set Seat type to Read-only (client), send. The default is still Teammate, so nothing changes unless you choose it.
A read-only seat sees the whole dashboard. Links, Link Pulse, app-open rates, the audience, the share cards, the exports — everything a full seat sees, on web and on mobile. They just can't change any of it.
The part that makes it real
Most software ships this feature as disabled buttons.
That is not a permission system. It's a suggestion. A disabled button is a CSS class; the request it would have sent is still sitting there, still accepted by the server, one browser console away from anybody who's curious. If the only thing standing between a client and your live campaign is a gray button, the client has full access and doesn't know it yet.
So we didn't build it that way. Read-only in Zippy is one gate in front of the entire dashboard API. Every request that would change something — create a link, edit a destination, delete a folder, add a webhook, connect an Instagram account, invite another person, rename the workspace — is refused for a read-only seat, at the server, before it reaches the code that would have done the work.
One gate, not sixteen checks. That distinction is deliberate too: a permission you have to remember to check in sixteen places is a permission you will forget in the seventeenth. Ours keys off the request itself, which means the feature we ship next month is covered on the day it exists, not on the day somebody remembers to go back and add a check to it.
We test it by making the requests, not by looking at the buttons.
What a read-only seat can still do
- Read everything, and export what their plan includes.
- Download QR codes and share cards.
- Unsubscribe themselves from emails. Withdrawing consent is never gated — not by plan, not by role, not by anything. Same law as deleting your account.
And the honest bit about seats
Team seats are a Legend feature — three of them. Hero is a single-seat plan, which means a solo creator who wants to add one read-only client currently has to jump to $49.
We're aware that's an awkward edge, and we haven't quietly decided it's fine. It's flagged and being looked at rather than defended. If you're in exactly that spot, tell us — that's the kind of thing that moves a number faster than any amount of internal debate.
Read more
- Docs: Team seats & the read-only client seat
- Changelog: The read-only client seat
- Also shipped today: your logo in your QR