New on 11 October: Releases, scheduled launches, Tasks and comments on every field.See the Studio

Galley
Log InTalk to Us

Find it in the docs

Type a word from any heading, such as key, webhook or beacon.

29 headings in both guides.

Security

Hand out keys without handing over the site

Each key reads one site, shows once, and expires on a date you pick. Editors can draft, and only people you trust can publish.

Read the RulesTalk to Us

What a key can reach

  • 1

    Site per key

    A key never reads a second site

  • 30, 60, 90

    Days a key can live

    Or pick an exact date instead

  • 28

    Tables behind row-level security

    Every table in the database is covered

  • 0

    Cookies set by the beacon

    A visitor is a hash, new each day

The rules

Rules for Every Key

Every key lives by the same few rules. Six of them.

  1. Keep Keys Read-Only

    A key can read one site and write nothing

  2. Keep Keys Hidden

    A key shows once, and Galley keeps a fingerprint

  3. Keep Keys Short-Lived

    Every key can carry an end date

  4. Keep Contributors Drafting

    Contributors can draft, and the database stops there

  5. Keep Forms Honest

    Messages from other sites are refused at the door

  6. Sign Every Webhook

    Your site can check who sent each one

The detail

How Each Rule Holds

A key belongs to one site and answers read requests only. It is the letters gal_ and 40 more characters, shown once. Galley stores a SHA-256 fingerprint, so the database holds nothing that works as a key. Revoke one and requests with it get a 401.

A key expires on a date you choose, or after 30, 60 or 90 days. Drafts need the site’s preview token, which the site holds and a visitor never sees.

The database enforces who may do what. Row-level security covers all 28 tables, and a trigger called guard_contributor stops a contributor from publishing, unpublishing or deleting, whatever the app or an API call asks.

Forms check the origin of every message and drop anything a honeypot catches. A form accepts up to 8,192 bytes and allows ten messages per connection every ten minutes. Each site lists its own allowed origins for browser reads.

Webhooks carry an HMAC-SHA256 signature in x-galley-signature, wait five seconds for an answer, and write a delivery log. A failed delivery is logged and not retried.

The beacon sets no cookie. A visitor is a salted hash of connection, browser and date, thrown away at midnight. Every change lands in the Activity ledger with who made it and when.

Questions We Get

What can a leaked key do?

Read the published content of one site. It cannot write, publish or reach another site, and you can end it from the API tab. Requests with a revoked key get a 401.

Who can publish?

Owners and editors. A contributor saves drafts, and the database refuses publishing, unpublishing and deleting.

Does Galley track my visitors?

It counts views. No cookie is set and nothing is stored on the visitor’s device. A visitor is a salted hash that is thrown away at midnight.

Has anyone outside audited Galley?

No outside audit is on file. What exists is our own check: scripts/check-backend.mjs makes a throwaway site and walks every path of the backend against a running Galley. We wrote that test, so read it as ours.

Where does the data live?

In a Supabase database, behind row-level security. The desk itself runs on Vercel.

Break it

Find a Hole

If a key can do more than this page says, please write to us. A person reads every report. Thank you.

Write to Us