Private Notes

Notes without website: true

Any note without website: true is not publicly served. If someone navigates to its URL, they see a placeholder page — the note content is never exposed.

These notes are still indexed by the Dataview engine and can appear in query results (titles and metadata only, not body content).

Per-note access token

Add access_token: to a note's frontmatter to share it privately:

---
website: true
access_token: mysecret
title: Draft Post
---

Share the note as /draft-post?token=mysecret. Once a visitor visits with the correct token, their session tracks that URL as unlocked — they can navigate away and return without needing the token again.

Each note has its own independent token. Unlocking one note does not unlock others.

Master key

The ACCESS_TOKEN environment variable acts as a single key that unlocks all private notes:

ACCESS_TOKEN=master-unlock-key

A visitor who knows the master key can pass it as ?token=master-unlock-key on any URL.

Coexistence

Both methods work simultaneously. A visitor with the master key can unlock everything; a visitor with a per-note token can only unlock that specific note.