Clickport
Start free trial
Dashboard Engagement Tracking Session Tracking Goal Conversions Filtering & Segments Privacy First Real-Time Analytics Bot Protection vs Google Analytics vs Matomo vs Cloudflare All comparisons
For Bloggers For Publishers For Affiliates For E-commerce For SaaS For Agencies
How It Works Blog Updates Documentation UTM Builder GDPR Checker GA4 Data Loss Estimator GA Legal Status GA Problems WordPress Analytics Bot Traffic AI Traffic Ecommerce Analytics Comparisons WordPress Custom Events About Contact Status

Share links

Share links give anyone with the URL read-only access to a single site's dashboard. No account, no login, no password on the recipient's side. You send a URL, they open it, they see the same panels, filters, and date ranges that you see. Useful for clients, stakeholders, contractors, and anyone you want to keep in the loop without onboarding them as a real user.

Share links are off by default, per-site, and managed from /<domain>/settings/share-links. Only the site owner can create or revoke them.

What the recipient sees

When someone opens a share link, the dashboard loads in read-only mode. They see:

  • All KPIs, panels, the hourly chart, and the realtime view for that one site.
  • All date ranges, comparison periods, and filter dimensions.
  • Goals, custom events, ecommerce revenue, and the sessions panel.
  • The site's favicon and domain name in the dashboard header.

They do not see:

  • The site switcher. Only the one site behind the link is visible.
  • Account, billing, security, danger zone, or any settings pages.
  • Your name, email, plan, pageview usage, or any other account-level information.
  • Other sites on your account.

Recipients can still apply filters, change the date range, drill into sessions, and export reports. These actions are local to their browser; they do not write anything back to your account.

Creating a share link

Open /<domain>/settings/share-links and click Create share link. A new entry appears in the list with a one-click copy button. The URL format is:

https://clickport.io/share/<domain>?auth=<token>

The token is 12 hex characters generated server-side with a cryptographic random source. Each link gets a unique token, and tokens are never reused after revocation.

Share links
Anyone with the link can view this dashboard in read-only mode.
Treat the URL like a password. Anyone who has it can view the data. Send links over channels you trust (email, password manager, encrypted chat) and revoke promptly when access is no longer needed.

Revoking a share link

In the list, click Revoke next to the link you want to disable. The button asks once more (red Revoke?) and then the link is killed immediately. Anyone holding the URL will see "Share link not found or has been revoked" on their next page load.

Revocation is permanent. The token cannot be reactivated. If the same recipient still needs access, create a new link.

Limits

  • 10 active links per site. Once you hit the limit, the Create share link button is disabled and labelled "Limit reached (10)". Revoke unused links to free up slots.
  • One site per link. A link only ever resolves to a single site. To share two sites, create one link per site and send both URLs.
  • No expiry. Share links do not auto-expire. They stay valid until you revoke them. Plan to revoke at the end of an engagement rather than relying on time-based expiry.

Security

A few things to know about how share links are secured on Clickport's side:

  • Token entropy. Each token is 12 hex characters, 48 bits of entropy. Even at sustained brute-force rates against the public resolve endpoint, finding a valid token would take longer than is meaningful.
  • Rate limiting. The public token-resolve endpoint is capped at 30 requests per minute per IP. Enumeration attempts get throttled fast.
  • No personal data exposure. The resolve endpoint returns only the site's id, domain, timezone, and favicon. It does not return owner email, plan, or any account-level information.
  • Revocation is real. Revoked links return 404 on the resolve endpoint, so even cached frontends fail to load data on the next request. There is no client-side trust.

If you suspect a link has been leaked or distributed beyond its intended audience, revoke it and create a new one. The new URL will have a different token; the old one stays dead forever.

Common uses

  • Client reporting. Each client gets one link for their site. They check the numbers on their own schedule. See the Agencies page for the full agency workflow.
  • Internal stakeholders. Drop a URL into a Slack channel so non-technical teammates can pull numbers without creating accounts.
  • Contractors and freelancers. Give time-bounded visibility during an engagement. Revoke when the work ends.
  • Read-only on your own devices. A share link works without a session, so you can pin one in a kiosk browser, a TV dashboard, or a status display without leaving a logged-in session running.
Need write access? Share links are read-only by design. There is no setting to make a share link editable. If you need someone to genuinely manage a site (change goals, edit settings, see billing), they need their own Clickport account on your team.
Previous Site Management