Global Settings
How to access global settings
Click External Share button from the left panel of the Confluence page.
Click Global Settings.
Global Settings
Permissions
In the Permissions tab, you can restrict and grant access to users that can take the following actions:
View own shares on page
View all shares on page
Create new shares
Edit share
Delete share
Send share by email
View all shares from space
Each of the above mentioned permissions can be set individually using groups.
Custom Email
In the Custom email tab, you can set your custom email. It will use that carrier to deliver any outgoing emails from External Share.
Email Template
In the Email Template tab, you can customize title, content and template of outgoing emails. You can use dynamic values to include External Share specific data to be shared.
Page Customization
In the Page Customization tab there are 5 sub-tabs that give to a user a variety of modifications can be made to shared pages:
Custom Domain
In the Custom Domain tab, you can configure a custom domain to make your shares available in your own domain. You can also use your own homepage.
Other
The Others tab provides access to the following advanced configuration settings.
Custom Content Security Policy
Allows you to permit embedding External Share links within iframes. For more information, refer to the Iframe Support (CSP) documentation.
Origin Opener Policy
The
Cross-Origin-Opener-Policy(COOP) header isolates your site's browsing context from other origins. This is important for two reasons: Security — Prevents attackers from accessing window references or shared memory. Performance — Safely enablesSharedArrayBufferand other high-performance browser features.Available options:
none,unsafe-none,same-origin-allow-popups,same-origin,noopener-allow-popups
Origin Resource Policy
The
Cross-Origin-Resource-Policy(CORP) header allows a server to control which origins are permitted to load its resources, such as images, fonts, and stylesheets.Available options:
none,same-site,same-origin,cross-origin
Origin Embedder Policy The
Cross-Origin-Embedder-Policy(COEP) header defines how the browser handles cross-origin content embedded in your site. It is used to:Enforce stricter isolation between your origin and external origins.
Prevent data leaks across iframes and other embedded resources.
Improve protection against Spectre-like side-channel vulnerabilities.
Available options:
none,unsafe-none,require-corp,credentialless
SameSite Cookie Restriction
Leave default 'Lax' for a safer option that restricts cookies to same-site contexts. Select 'None' to allow cookies to be sent in all contexts, which is necessary for logging into password-protected External Shares within iframes on third-party sites.
Fallback User for Inactive Shares
Assign a fallback user API to automatically take over shares created by users who no longer have access on Confluence instance or to view the space of shared page. This ensures that shared content remains accessible and functional, even if the original user is inactive.
Resolving External Attachments When using Confluence macros like Insert Excerpt or Include Content (Page), attachments from the original source pages may not be accessible if those pages are outside the current share's scope.
When enabled: The app will serve attachments from external pages using the permissions of the current page share, bypassing the need for a dedicated attachment share for the source page.
Requirement: The "View attachments" option must be active on the current share for this to function.
Default: This setting is disabled by default to maintain strict access control.
AI Integration
In the AI Integration tab, you can connect an AI provider so that external viewers can search a shared page structure with plain-language questions instead of keywords. Until a provider is configured here, the AI options in Space Settings and in share link settings are visible but disabled.
The tab has three sub-tabs:
General: provider, API key, model, monthly token budget, and the site-wide switch that turns AI search on.
Data sharing: what is sent to the provider, including PII redaction, page excerpts and labels.
Usage: current-month searches, failures and token consumption, broken down by share.
For setup steps, data-sharing options and troubleshooting, see AI-Powered Search.
Actions
In the Actions tab, you can manage global cleanups and manual data synchronization for your instance.
Delete all External Share links
This option allows you to permanently delete all existing External Share links across the instance.
Warning: Once deleted, these links cannot be recovered.
Clear user caches
Clears the user cache and user operations cache for the current Atlassian host.