Any way to write permission query that will allow not authenticated users to read the whole Document by providing secretToken stored in its field? Something similar to link sharing in google drive (in my case, anyone providing secretToken in a Document query can view).

Not directly. However, you can use a resolver function to achieve the same. The secretToken would be the function parameter, and the resolver function would use a root token to access Document, so you can remove

READ

permission from the Document Type itself

Thanks, i’ll try this