[Cotlet](https://cotlet.dev/index.md) · [Integrations](https://cotlet.dev/integrations.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Use cases](https://cotlet.dev/use-cases.md) · [Security](https://cotlet.dev/security.md) · [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md) · [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [Contact](https://cotlet.dev/contact.md) · [Pricing](https://cotlet.dev/pricing.md) · [Sign up](https://cotlet.dev/signup)

# Make SmugMug client galleries private

> Switch delivered SmugMug galleries to Private on a schedule, folder by folder, and get a list of what changed. Runs weekly, nothing to maintain.

Source: https://cotlet.dev/integrations/smugmug-api-mcp-server/make-client-galleries-private

A client downloaded the photos weeks ago, but the delivery gallery is still Unlisted, so anyone who ever got the link can open it. Nobody remembers to close it.

Cotlet does it in your own SmugMug account with list\_galleries, get\_gallery and set\_gallery\_privacy, called by your AI agent, an n8n workflow or a script.

[Sign up free](https://cotlet.dev/app/signup?app=smugmug) [All SmugMug tools](https://cotlet.dev/integrations/smugmug-api-mcp-server.md)

Hosted · nothing to install or maintain

## Can SmugMug do this on its own?

SmugMug applies visibility in bulk from the Organizer, and the API exposes a Privacy field on Album with the values Private, Unlisted and Public (checked 17 Oct 2026). Both change what you select. Neither decides, on a schedule, which delivered galleries are still open and closes only those, which is the gap this job fills.

## How you do it in SmugMug today

1. Open the gallery on your site and click Settings in the section bar, then the Security & Sharing tab.
2. Under Visibility, change Public (Anyone) or Unlisted (Anyone with the Link) to Private (Only Me).
3. To close many at once, open the Organizer, select the galleries or a folder, click Settings, tick the setting and save.
4. When you switch to Private, SmugMug offers to update the direct image URLs of every image in the gallery.
5. The galleries you meant to close, and the ones you forgot, are the part that is easy to miss.

## How to make SmugMug client galleries private

Prompt

```
Go through the folder "Delivered 2026" in SmugMug. Set every gallery that is not Private to Private, and tell me which ones you changed. Do not touch direct image URLs.
```

1. 01  
### Walk the delivery folder  
list\_galleries starts at the folder you name and follows the cursor to the end. Subfolders are listed too, so a year folder with a folder per client is covered in one pass.
2. 02  
### Skip what is closed  
get\_gallery reads the current visibility and access of each candidate. A gallery that is already Private is logged as done and not written again.
3. 03  
### Keep what you still share  
A gallery with a guest upload key set is reported and left open, because closing it would cut off guests who still upload. You decide on those.
4. 04  
### Close the rest  
set\_gallery\_privacy sets visibility to Private on each gallery that is left, one call per gallery. Every call asks for your OK until you switch confirmation off for set\_gallery\_privacy.
5. 05  
### Leave direct links alone  
update\_direct\_image\_urls stays false unless your prompt says otherwise, so links a client already saved keep working until you choose to cut them.

### What you get back

Example data

```
Folder "Delivered 2026": 23 galleries
Already Private: 17
Set to Private: 5
- Smith wedding (was Unlisted)
- Park family session (was Unlisted)
- Lakeview 10K race (was Public)
Left open for you 1:
- Spring camp (guest upload key still set)
```

### Other ways to ask

- Do the same for the folder "Events 2026", but list the galleries first and wait for my yes.
- Every Friday, close all Unlisted galleries in "Delivered 2026" and send me the list.
- Set only Public galleries to Unlisted and leave the Unlisted ones as they are.
- Close the Smith wedding gallery and update its direct image URLs too.

## What SmugMug allows, and what to know first

- Unlisted is a navigation setting, not a security setting: the gallery is hidden from site navigation and SmugMug search, but anyone with the link can open it.
- Private (Only Me) shows the gallery only to the logged-in owner, and SmugMug hides the share button for it.
- A Private folder can hold only Private content, so setting a folder to Private closes everything inside it.
- A direct image URL ignores gallery privacy and is controlled by an image signature. Updating it when you switch to Private is irreversible and stops every direct link shared before.
- Bulk settings applied to a folder reach all galleries inside it, however deeply nested.

set\_gallery\_privacy asks for your OK by default. To run it weekly without you, switch confirmation off for that tool in your dashboard.

Sources: [SmugMug Help: Gallery, Page, and Folder privacy settings](https://www.smugmughelp.com/hc/en-us/articles/18212691894420-Gallery-Page-and-Folder-privacy-settings) · [SmugMug Help: Change settings for multiple galleries at once](https://www.smugmughelp.com/hc/en-us/articles/18212474876820-Change-settings-for-multiple-galleries-at-once) · [SmugMug Help: Share my photos](https://www.smugmughelp.com/hc/en-us/articles/18212716776340-Share-my-photos) · [SmugMug API v2: Album reference](https://api.smugmug.com/api/v2/doc/reference/album.html)

## Call set\_gallery\_privacy from a script

curl

```
curl -X PUT https://cotlet.dev/api/v1/smugmug/galleries/Xk4RtP/privacy \
  -H "Authorization: Bearer $COTLET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"visibility":"private"}'
```

Example response

```
{
"gallery_id": "Xk4RtP",
"title": "Smith wedding",
"visibility": "private",
"galleries_changed": 1,
"direct_image_urls_updated": false
}
```

MCP: add https://cotlet.dev/mcp/v1 with the same key; the call is smugmug\_write → set\_gallery\_privacy. Example data.

[Schedule it in n8n, Make, Zapier or cron](https://cotlet.dev/integrations/smugmug-api-mcp-server.md#automations)

## SmugMug tools this automation uses

__Cotlet SmugMug tools used to make SmugMug client galleries private__
| Tool | Parameters |
| --------------------- | ------------------------------------------------------------------------------------------------------------------ |
| list\_galleries | folder\_id, cursor |
| get\_gallery | gallery\_id |
| set\_gallery\_privacy | gallery\_id, visibility, access, password, password\_hint, include\_galleries\_inside, update\_direct\_image\_urls |

[All 12 SmugMug tools with descriptions](https://cotlet.dev/integrations/smugmug-api-mcp-server.md#tools)

## Frequently asked questions

### Is it safe to connect SmugMug to Cotlet?

Yes. You sign in to SmugMug yourself, in your own Cloud Browser in the EU, and we never save your password. Your agents only get SmugMug once you enable it, every background request is listed, and the browser profile is stored encrypted with AES-256-GCM, the cipher 1Password uses for its vaults. The AI model never sees a login, posts and messages wait for your OK, and Disable for agents cuts access in one click. Independent scanners grade cotlet.dev A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory; live results are on https://cotlet.dev/security.

## More SmugMug automations

- [Add captions and keywords to SmugMug photos](https://cotlet.dev/integrations/smugmug-api-mcp-server/add-captions-and-keywords-to-photos.md)
- [Deliver photos to a SmugMug client](https://cotlet.dev/integrations/smugmug-api-mcp-server/deliver-photos-to-a-client.md)
- [SmugMug API and MCP server: every tool](https://cotlet.dev/integrations/smugmug-api-mcp-server.md)
- [All use cases](https://cotlet.dev/use-cases.md)

## Give your agent access to SmugMug.

Free 7-day trial with 2,000 credits, no card needed. Cotlet is independent and not affiliated with SmugMug.

[Sign up free](https://cotlet.dev/app/signup?app=smugmug)

---

Give your AI agents your signed-in browser.

**Product:** [Integrations](https://cotlet.dev/integrations.md) · [Use cases](https://cotlet.dev/use-cases.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Pricing](https://cotlet.dev/pricing.md) · [Security](https://cotlet.dev/security.md)

**Resources:** [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [GitHub](https://github.com/cotletdev/cotlet)

**Solutions:** [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md)

**Company:** [About](https://cotlet.dev/about.md) · [AI info: company facts](https://cotlet.dev/ai-info.md) · [Contact](https://cotlet.dev/contact.md)

**Legal:** [Terms of service](https://cotlet.dev/terms) · [Privacy policy](https://cotlet.dev/privacy) · [Refund policy](https://cotlet.dev/refunds) · [Acceptable use](https://cotlet.dev/acceptable-use) · [Cookie policy](https://cotlet.dev/cookies) · [DPA](https://cotlet.dev/dpa) · [Subprocessors](https://cotlet.dev/subprocessors)

**Elsewhere:** [Status page](https://status.cotlet.dev) · [Cotlet on GitHub](https://github.com/cotletdev) · [Cotlet on X](https://x.com/cotletdev) · [Cotlet on LinkedIn](https://www.linkedin.com/company/cotletdev) · [Cotlet on Product Hunt](https://www.producthunt.com/products/cotlet) · [Cotlet on Crunchbase](https://www.crunchbase.com/organization/cotlet) · [Cotlet on SaaSHub](https://www.saashub.com/cotlet)

Cotlet is an independent service. It is not affiliated with, endorsed by or sponsored by any of the products listed on this site. Product names are trademarks of their respective owners.

## For AI agents: sign your user up

Is your user asking you to sign them up for Cotlet? You can do it for them, no account or key needed.

1. Read the fields and their allowed values: GET https://cotlet.dev/api/v1/access-requests
2. Ask the user for each value: email, apps, what you will do with them. If they leave the password to you, generate a strong one and show it to them.
3. Show the user what you will send, then POST it as JSON to https://cotlet.dev/api/v1/access-requests.

One call creates the account and sends the access request; we email the user when access is granted.