Share pitch decks and docs securely with Papermark

A pitch deck attached to an email is a file you cannot take back. It gets forwarded, it sits in a downloads folder, and you never learn whether anyone opened slide 12. Papermark is a link in front of the file. You upload the deck, you set who can open the link and for how long, and you can see that a visit happened. The PDF is not the thing you send.

This tutorial is the dashboard path first, because that is how you share a real deck today, and then the API call that creates the same kind of link once the file already has an id. The Papermark link on this page includes an offer of 20% off for 3 months. The catalogue record is Papermark on IQ.net. IQ.net does not host your deck and does not see who opened it.

What a careful link needs

Before you upload, decide the rules. Write them down so you do not click through the sharing screen on autopilot.

• Who may open it. A named email address, or a small list, beats "anyone with the link" for a fundraising deck.
• How long it stays valid. A date after the meeting is enough. An immortal link is how last year's numbers keep circulating.
• Whether they can download. If the point of the link is that you can turn it off, leave download off until someone has a reason to need the file.
• Whether you want a password on top of the email check. A password helps when the link might be forwarded inside a firm and you still want a second gate.
• Whether you want to know when it is opened. Turn notifications on for a live process. Turn them off if you are sharing a document so widely that your inbox will be useless.

Papermark's link API describes these as controls on the link: a password, an expiry, an email allow list, download permission, a watermark, and notifications. The dashboard is the same controls with labels. Use the dashboard until you have shared one deck by hand. Automate the second one.

Open Papermark

Upload the deck and create the link

Create the Papermark account from the button on this page if you do not have one, so the offer of 20% off for 3 months is the offer you are accepting. Then:

1. Upload the PDF. Use the file you would actually send, not a folder of working drafts. Name it so you can tell versions apart. northwind-seed-2026-11.pdf is a better name than final-final.pdf.
2. Open the document and create a share link. Give the link a name that says who it is for, such as Northwind — Ada at Northstar. You will have more than one link if you send the deck to more than one firm. Names are how you revoke the right one later.
3. Require an email before viewing, and put the recipient's address on the allow list if the product gives you that field. A link that asks for any email is weaker than a link that only accepts the address you were introduced to. Use the stricter one for a first meeting.
4. Set a password and send it in a separate channel from the link. The email that contains the URL should not also contain the password. A chat message, or a sentence spoken on the call, is enough.
5. Set an expiry. For a first meeting, a week after the call is a reasonable default. You can always create a new link. You cannot un-forward a file that was downloaded in month three.
6. Turn downloading off. If the investor asks for a copy, you can enable it on that link or send a second link. Starting with it on means the first open is also a permanent copy.
7. If a watermark is available, use one that shows the viewer's email and the date. A watermark does not stop a photograph of the screen. It does make a casual forward less anonymous.
8. Turn on notifications for this link.
9. Copy the Papermark URL. That is the only URL you put in the email.

Send a short note. Do not attach the PDF as a backup. The backup is how the link stops mattering.

Subject: Northwind deck

Ada — here is the deck we discussed: https://www.papermark.com/view/…

The link asks you to confirm this email address, and it expires next Friday.
I will send the password separately. Tell me if you want a copy you can download.

Send the password only after they have the link, and only to the same person. If an assistant asks for it, decide on purpose whether the assistant is on the allow list. Do not forward the password to a new address because someone asked from a different domain.

If you need to undo the share, revoke or delete that link in Papermark. The URL should stop opening. That is the property you paid the workflow for. Revoking does not delete copies someone already downloaded, which is why download starts off.

Create the link from the API

Once a document exists, Papermark's API can mint the link. You need a token from their dashboard. The docs describe dashboard tokens that look like pm_live_…, sent as a bearer token. Creating a link requires the links.write scope. Reading analytics requires analytics.read. Create a token with only the scopes you are about to use, and store it as PAPERMARK_TOKEN. It is a secret. It does not belong in the deck, in git, or in an agent transcript.

The create endpoint is POST https://api.papermark.com/v1/links. The docs describe a body that can set a password, an expiry, and an email allow list, and the response includes the public url plus flags such as allow_download and enable_notification. A first automated link, after you already know the document id from the dashboard or from their document API, looks like this:

curl -sS -X POST "https://api.papermark.com/v1/links" \
  -H "Authorization: Bearer $PAPERMARK_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "document_id": "YOUR_DOCUMENT_ID",
    "name": "Northwind — Ada at Northstar",
    "expires_at": "2026-11-20T00:00:00Z",
    "allow_download": false,
    "enable_notification": true
  }'

Read the JSON that comes back. The field to send to a person is url. If the call returns 401, the bearer token is missing. If it returns 403, the token does not have links.write. If it returns 422, a field is the wrong shape. expires_at has to be a timestamp their API accepts. Their error body names the field. Fix that field. Do not retry blindly.

Password and allow-list fields are part of the same create call in their reference. The response shows is_password_protected and allow_list. Set those in the body when you move beyond the minimal example, using the field names in the current Papermark API reference rather than a name you remember from another product. If a field you send is rejected, the 422 details are the spec for that account's API version.

A data room is a different object from a single document. Papermark's API lets a link point at a dataroom_id instead of a document_id. Use a data room when you are sharing a set of files under one permission boundary. Use a document link for one deck. Do not build a data room for a single PDF.

Uploading the bytes is a separate step from creating the link. Papermark documents direct uploads for large files. For the first deck, upload in the dashboard, copy the document id, and only then call the link endpoint. Automate the upload after you have one link that opens.

The same call from Node, which is what you would put behind a button in an internal tool:

const response = await fetch("https://api.papermark.com/v1/links", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAPERMARK_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    document_id: process.env.PAPERMARK_DOCUMENT_ID,
    name: "Northwind — Ada at Northstar",
    expires_at: "2026-11-20T00:00:00Z",
    allow_download: false,
    enable_notification: true,
  }),
});
if (!response.ok) {
  throw new Error(`Papermark ${response.status}: ${await response.text()}`);
}
const link = await response.json();
console.log(link.url);

Log the link id and the name. Do not log the token. The URL is not as sensitive as the token, but it is still a capability. Send it to the recipient through the email you already trust. Do not drop it in a public channel.

Read who opened it

Papermark documents aggregate analytics for a document link at GET /v1/analytics/links/{id}. The response they publish includes total_views, total_duration_seconds, and unique_viewers, for a window you can bound with since and until. A link that points at a data room is not served by that route. Their docs say to use the data room analytics endpoint for those.

curl -sS "https://api.papermark.com/v1/analytics/links/YOUR_LINK_ID" \
  -H "Authorization: Bearer $PAPERMARK_TOKEN"

The token needs analytics.read. A 404 on a link you just created usually means the id is a document id, or the link is a data room link and you called the document route. Check target_type on the link object before you pick the analytics URL.

Use the numbers as a signal, not as a story. A view means someone opened the link. A duration means the viewer session reported time. It does not mean they read every slide, and it does not mean they will take the meeting. Unique viewers tells you whether the allow list is being respected in practice. If unique viewers climb past the people you named, the link is wider than you thought. Tighten the allow list or revoke it.

The dashboard shows the same idea without the call. Use the dashboard while you are still sharing a handful of decks. Use the API when a CRM or a script should record "link created" and "viewed" next to the intro. Store the link id on the deal. Store the URL only where the sender can see it.

A checklist before you hit send

Run this every time, including the tenth deck, when you are sure you remember.

1. The file is the version you mean. Open page one and the ask slide.
2. The link name is the recipient, not "new link."
3. Expiry is set.
4. Download is off, unless you decided otherwise in writing.
5. The allow list is the person you think it is. Check the domain.
6. The password, if there is one, is not in the same message as the URL.
7. You can revoke this link without revoking the one you sent yesterday. If you cannot, you reused a link. Make a new one.
8. The email does not also attach the PDF.

If a founder or an associate asks you to "just send the file," send the link and one sentence on why. You can enable download for them after they have opened it. You cannot get a forwarded attachment back.

What this does not do

A link is not a full security program. It does not stop a recipient from photographing a slide. It does not replace an NDA, though Papermark's API describes an option to require an agreement before viewing on plans that include it. Turn that on when you already have the agreement in their product. Do not assume a view implies they signed something you never configured.

It also does not review the content of the deck. Numbers, logos, and customer names are your problem before the upload. A watermark with someone else's email on it is a bad surprise if the slide was already wrong.

IQ.net's page for the product is Papermark. The offer on the affiliate link is 20% off for 3 months. If the note you are sending came out of a meeting, the companion guide is Automate meeting notes and follow-ups with AI. Write the five-line recap first. Attach a Papermark link. Leave the PDF out of the thread.

Open Papermark