Share data securely
Use the minimum access needed for the task. A caregiver reading glucose needs viewing access; a remote-control workflow is a separate authorization decision.
Create and distribute access
- Keep the site private using Pro’s Make My Nightscout Site Private option.
- Follow Admin Tools token creation and create a named readable subject for each recipient/device where practical.
- Share the URL and token through an agreed private channel. Treat
?token=...links as credentials, not public links. - Verify the recipient can view the intended site and current readings with the expected permissions.
End or replace access
Remove the subject in Admin Tools when access is no longer needed, then check the old token fails. If a token was shared among several people, changing that token affects all of them; issue separate replacements to those who should retain access.
If the master API Secret was exposed, change it and update affected uploaders rather than assuming deletion of a follower token fixed the exposure. Remove credentials from screenshots, log excerpts and printed browser headers.
Sharing a report is different from continuous account access. Use report export guidance when a one-time snapshot is sufficient. A recipient may retain a previously sent file after live access is revoked.