A document server residing on a network behind a firewall provides secure access to documents or services residing thereon. A first user outside the firewall communicates with the document server over an established first secure session to generate a token in a database of tokens on the document server. The first user digitally signs the public key of a second user and an identifier of the token. The first user transmits a URL token to the second user that identifies the location of the document server and the token identifier. When the second user outside the firewall redeems the URL token at the document server, the document server and the second user establish a second secure session. The document server authenticates the URL token against the second secure session before providing the second user with access to the document or service.