Guests cannot view all entries on a form – they can only access entries that have been specifically shared with them. Entries are shared in one of the following ways:
- When a guest is sent an authenticated Save & Resume link or Workflow link for the Public role – either automatically through an email notification or manually from the Entries page.
- When a guest is assigned to the Public role under the Share With settings in the Workflow Role dialog by selecting an Email field or a Person field on the form.
For more details, see our guide on Sharing Forms and Entries.
If you need someone to view all entries on a form, you’ll need to invite them to your organization as a User.
When collecting submissions through a public link, you can require guests to verify their email before accessing the form. This adds a security layer while also allowing you to track who completed each submission.
-
Enable Guest Access.
-
In your form’s Build page, choose how to capture user details:
- Use
Entry.User.Emailto populate fields with the email address of any authenticated user or guest (including unknown guests).
- Or use a Person field set to default to Current User – this option only allows guests on a guest list or organization users to access the form.
- Use
-
Open the Workflow settings. Under Public Links, set Require Authentication to Guests & Users. If you’re using a Person field to verify guests, set Allow Links to require that the Person field is filled out.
-
Make sure to save your changes.
What happens next:
Anyone accessing the form’s Public link will be required to authenticate their email – either by logging in as a user or entering a one-time verification code if they’re a guest.
You can track authenticated guest users and their activity from the Guest Access section in your organization’s settings.
Learn more about setting up Guest Access.
To set a guest as inactive, open your connected Person Form and update their entry. If your form includes an Is Active? field, change this value to No for the guest you want to deactivate.
If you want to deactivate an entire guest list, you can also deselect the corresponding Person Form in the Allowed Guest Types settings.
Keep in mind that even if a guest is inactive or removed from a list, they can still log in if they’ve been sent an authenticated Save & Resume or Workflow link and there’s a Public role view available for that form. To fully restrict access, make sure no authenticated links or Public views remain available to them.
Learn more about setting up Guest Access.
You can embed public forms on your website, but the guest login page is not embeddable.
If you’d like guests to access secure forms or tasks, you can either embed individual public forms that require guest login or share a direct link to your organization at https://www.cognitoforms.com/yourorganizationname. Make sure to replace ‘yourorganizationname’ with your organization’s Cognito Forms URL – you can find this in your browser’s address bar when logged in to your organization.
Learn more about setting up Guest Access.
A user is someone with an account in your Cognito Forms organization. They can access the full platform, build forms, and manage workflows based on their assigned permissions.
A guest is an external participant who logs in to your organization’s guest portal to submit, view, or update specific forms or entries that have been shared with them. Guests don’t have a Cognito Forms account and can only see what’s been explicitly shared with them.
Learn more about setting up Guest Access.