Preview Links
Preview links let you share an unpublished variation with anyone — a client, an executive, a stakeholder without an A vs B account — by sending them a regular URL with a signed token appended.
Generating a link
Open the experiment in the dashboard
Click Generate preview link
Pick the variation
Set the expiry
Copy and send
What the recipient sees
The recipient opens the link in any browser. They land on your production page, which is otherwise unchanged — no editor panel, no login prompt — but with the variation applied. The link works on Safari, mobile browsers, and any device the recipient happens to be using.
1https://your-site.com/landing-page?avsb_preview_token=eyJhbGciOi...The signed token is appended as a query parameter. The snippet runtime detects it, verifies the signature, and forces the visitor into the corresponding variation for the rest of their session.
Customer-visible preview path
For convenience, preview links can also be presented as a short dashboard URL. The dashboard at <dashboard>/preview/<token> redirects the recipient to the underlying customer URL with the ?avsb_preview_token=<token>query string appended. This is the form the share dialog uses by default — it's easier to paste and looks tidier in email.
Expiry
- Default expiry — 30 days from the moment the link is created.
- Maximum expiry — 90 days. Past this, you need to generate a new link.
- Expired links — Return the unmodified production page. The recipient sees the live experience, not an error.
Revoking a link
If you need to cancel access before expiry — for example, the recipient is no longer involved in the project — open the share dialog and click Revoke next to the link. The token is invalidated server-side. Anyone who opens the link after revocation sees the unmodified production page.
Security model
Preview tokens are designed so that database compromise alone does not leak working preview links.
- Token generation — Each link uses a cryptographically random opaque string. The raw token is shown to you exactly once, at generation time.
- Hash-only storage — We store a one-way hash of the token, not the raw value. Verification recomputes the hash from the incoming request and looks it up.
- Signature verification — The token also encodes a signed timestamp and variation reference, both verified by the snippet before applying the variation.
- Scope — A token only forces the specific variation it was generated for. It does not unlock any other dashboard data, identity, or org-level permissions.