API Secret and access tokens

There are three different kinds of credentials:

• Pro account password: signs in to the hosting and billing portal.
• Nightscout API Secret: powerful access to the hosted Nightscout site, used by uploaders that require it.
• Access token: a separate Nightscout credential with assigned permissions; use a read-only token for a follower when supported.

Manufacturer cloud passwords belong only in the source’s official sign-in or the signed-in Pro Connect configuration.

Find your API Secret

1. Sign in to your Nightscout Pro account.
2. Open Site Settings for the site you want to connect.
3. Find API Secret (Min. 12 Characters). This field shows the site's existing API Secret.
4. Copy it privately into the uploader's API Secret field when that application's guide requires it.

Your Pro account password does not replace the API Secret. A follower that supports read-only access should use its own access token instead. If you change the API Secret, update every uploader that uses it. Never include the value in a support message or screenshot.

Make sharing deliberate

An unprotected site can expose health data to anyone with its URL. In Site Settings, review Make My Nightscout Site Private. A URL containing ?token=... is itself a secret: anyone with the link has that token’s access.

Create read-only access

1. Open your Nightscout site and authenticate as its owner.
2. Open the menu, then Admin Tools.
3. Choose Add New Subject, give the recipient/device a useful name and assign the role readable.
4. Save and copy the generated token into that follower’s token field or documented authenticated-URL format.
5. Check the recipient can view data and cannot perform actions outside the assigned role.

Use separate subjects for recipients so their access can be removed separately. Remove an unused subject in Admin Tools and check its old token no longer works.

If credentials are exposed

Revoke the affected token. If the API Secret was exposed, change it in Site Settings and update uploaders that use it. Do not send passwords, API Secrets, tokens, CareLink redirects, full card details or one-time codes to support.

Upstream access-control reference.