---
title: Access
description: How the four access modes apply through sherlink, plus the sherlink-specific fields on top.
---

# Access

sherlink enforces the same four access levels every shebang resource
uses — `private`, `password`, `allow_list`, `public` — see
[access modes](/concepts/access-modes) for what each one means to a
visitor. For a sherpage page, that policy can also be set through
`sherpage_set_access`; for a sherserve object, sherlink's own
`link_set_access` is the only way to change it, since the object itself
carries no policy of its own.

```
link_set_access({
  code_or_id: "<code>",
  access: "password",
  password: "…",
})
```

## Fields alongside access

Beyond the access level itself, `link_set_access` also carries the
fields that gate a resource regardless of its access level:

- `password` — required when setting `access: "password"`; pass `null`
  to clear a previously-set password.
- `expires_at` — an ISO 8601 timestamp after which the resource stops
  serving; pass `null` to clear it.
- `max_views` — a view budget after which the resource stops serving;
  pass `null` to clear it.

An expired or budget-spent resource answers as `expired` before its
access level is even checked — a dead `allow_list` resource never
demands a sign-in only to refuse afterward.

## Next

[The sl. url](/sherlink/the-sl-url).