AccessDropYour Box link works for you and nobody else. Start with who it's actually set to let in
Box gives a shared link three different access levels, not one, and a link can start out narrower than "anyone with the link" without you ever having chosen that. Here's what each setting does, from Box's own documentation.
Check your delivery link now, free
Paste the Google Drive, Dropbox, Canva or other link you give buyers. We open it from outside your account, the way a buyer would, and tell you what they’ll see. No sign-up.
A buyer says your Box link in their Etsy download won't open. You click it yourself, signed in, and it opens straight away. The first thing to check is usually the access level: Box shared links don't have a single on/off state. They have three different access levels, and the one your link is set to decides whether a stranger with no Box account can see anything at all.
Three access levels, not one "shared" setting
Box's own developer documentation lists the three values a shared link's access can be set to, and what each one actually means:
| Access level | Box's own description | What it means for a buyer |
|---|---|---|
| open ("People with the link" in Box's Share dialog) | "A public shared link. Anyone with the link may access the link." | The only level a buyer with no Box account can actually use |
| company ("People in your company") | "Anyone within your enterprise may access the link." | Box's help centre says people must be in your Box enterprise, or have a Box account on the same email domain — which shuts out buyers |
| collaborators ("Invited people only") | "Anyone collaborated on the content may access the link." | Blocks everyone except people you've individually added as a collaborator on that file or folder |
Two other settings that look like sharing but aren't
Even on a link correctly set to "open", two more settings can still stop a buyer cold. A password: Box's developer documentation describes the field as "A password required to access the resource." Box's help centre offers it on "People with the link" links, on paid Box accounts. If you turn this on, the link alone isn't enough, and the password has to live somewhere the buyer can actually see it, not just in your own head. And an expiry date: Box's documentation describes "An expiration time when the shared link will automatically disable." On a link that's been quietly sitting in old Etsy messages for months, that's the kind of setting that's easy to forget was ever switched on.
There's also a limit worth knowing before you go changing settings to fix a complaint: Box's documentation states: "You may only have one active shared link for a file, folder, or web link at any time." What isn't in Box's own documentation is whether editing that one link's settings, or generating a fresh one, changes the actual web address — so this page doesn't claim either way. If you've ever regenerated a Box link after a buyer complaint, treat the old URL already printed in past buyers' PDFs as a real risk until you've checked it still opens, rather than assuming it does.
What AccessDrop's own check can tell you here
Tested with curl on 19 October 2026, sending the same request AccessDrop's checker sends: a made-up app.box.com/s/ address, with an id that was never real, comes back as a plain HTTP 404, and AccessDrop's check reports any 404 as broken. The same made-up id on a www.box.com/s/ address came back as a 403 instead, which the check reports as a permission problem rather than a dead link. Either way it gets flagged, but the label differs, and like every result from the check it's a heuristic, not a guarantee.
What to actually do
- 1
Open the Box link's own sharing settings and read the access level
Don't just click the link signed in — that tells you nothing, since you can see anything you own. Check it's set to "People with the link" (Box's open level), not "People in your company" or "Invited people only".
- 2
Test it signed out, in a private window
The only honest test of what a buyer with no Box account actually sees.
- 3
If you set a password, put it in the PDF next to the link
Not in a separate message a buyer might never open. The link working and the file being reachable are two different things once a password is on.
- 4
Check whether an expiry date is set, and what it is
A link that worked at launch and stops months later, with no change on your end, is very likely this rather than anything wrong with the file.
The pattern here is the same one the OneDrive page and the Dropbox page on this site both cover: a cloud-storage share link usually isn't broken, it's set to the wrong audience, and the setting that caused it lives inside that provider's own interface, not in the URL itself.
AccessDrop (accessdrop.app) takes a Box, Drive, Dropbox or Canva link — a real shared file or folder, not a Transfer-style one-off — and turns it into a branded delivery PDF with a QR code and a short link you control. If a setting ever needs to change, you fix it once at the destination; if the destination itself needs to move, you repoint the short link instead of reissuing every buyer's PDF. £19 once, for a year, up to five links. It doesn't host your files, and it doesn't change Box's own access-level settings for you — getting those right, as above, is still on the seller.
See how the link check works
A real example delivery PDF, and what the weekly access check catches.
See a sample delivery