Share a dashboard

Let someone see a site’s numbers without an account: you make a link, they open it. The link shows the real dashboard, read only: the Overview and the reports, in their own language. It never shows single visits, visitors’ routes, labels or notes, settings, your plan or your usage, and it never reaches another site.

Make a link

In the site’s Settings › Sharing (/app/<your-domain>/settings#sharing), choose New link, give it a name so you know which is which (“For the client”), and Make link. Copy the link and give it to whoever should see the numbers. Only the site’s admins and owners can make, change or revoke links.

What you can add depends on your plan:

	Free	Starter	Pro	Agency
Shared links per site	1 open link	Up to 25, with a password, expiry, part, filters or embedding	Up to 25, with a password, expiry, part, filters or embedding	As Pro, with your logo

On a plan with links, a link can have:

• A password of at least 8 characters. Whoever opens the link types it once; it then works in that browser tab for 12 hours. Changing the password closes what the old one opened.
• An expiry date: from the end of that day, the link no longer works. Change or remove the date to make it work again.
• One part of the site (parts): it shows only the pages and events of that part, such as the app or the blog.
• Filters, as in the dashboard’s address, one per line, such as path:~/blog/* or country:BE (Filters). A filter keeps the visits that match it, with everything they did: path:~/blog/* shows the visits that read a blog post, also the other pages they read. To show only part of the site’s pages, make that a part. A link never filters on visitor or label.
• Hosts that may embed it (below).
• The Overview as you arranged it: which panels, in which order and how wide (Arrange the Overview your way). Without it, the link shows the default Overview.

Whoever opens a link with a part or filters sees them at the top, with a lock: they can filter further within it, never take them away. The AI page is left out of such a link, because the AI crawlers on it are counted for the whole site. A link for one part also leaves out what lies outside it: the site’s goals and funnels, entry and exit pages, and hostnames.

What the reader sees

• The Overview: the sentence about the period, the six numbers and the chart, insights, what stands out, sources, pages, places, devices, day and hour, goals and funnels. Not the example visit.
• The reports, with their tables, comparisons and CSV.
• AI, for a link that shows the whole site.
• Filters and periods, and the language and colour theme of their choice. Only filters many visitors share: country, channel, source, device, browser, system, language, page, entry and exit page, hostname, event, UTM source, UTM medium, campaign, goal and part, never a city, region, device model or app version, and never “is not”. A view they narrow down with filters keeps at least 5 visitors, otherwise it shows nothing. Periods are whole hours, at least one; a window of their own shorter than a day also needs 5 visitors.
• Your logo and name on top, on Agency (below); otherwise Nvivio’s. At the bottom, a small link to Nvivio.

They do not see: Visitors and single visits, Live, Bots, Settings and installation, Ask Nvivio, your plan, usage or retention, your other sites, your team or your account. The API answers none of it for a link either.

When it was opened

Each link shows when it was last opened and how often. Nothing is kept about who opened it: no address, no browser, no cookie.

Revoke a link

Revoke (click twice) stops a link at once, for good: the same address never works again. To give someone access again, make a new link. A link also stops when its site or organisation is deleted.

Embed it in your site

Name the hosts where the link may be shown in an iframe, one per line: www.client.be, or *.client.be for every subdomain. Only https, without a path, port or IP address. Copy embed code then gives you:

<iframe src="https://nvivio.com/share/<token>?embed=1" title="example.com" style="width:100%;height:1600px;border:0" loading="lazy" referrerpolicy="no-referrer"></iframe>

?embed=1 leaves out the bar on top. Add &theme=light or &theme=dark to fix the colours; without it the dashboard follows the reader’s system. On any other site the browser refuses to show it: the link’s page names exactly your hosts in its Content-Security-Policy: frame-ancestors. A link with a password asks for it inside the iframe too; it needs no cookie, so it also works where browsers block cookies of other sites.

Your logo

On Agency, your organisation’s logo and name stand at the top of every shared link instead of Nvivio’s, also when embedded. Set them under Settings › Sharing › Your logo: a PNG, JPEG, WebP or SVG of at most 100 kB. They apply to every site of the organisation. An SVG with scripts, event handlers or anything it loads from elsewhere is refused.

When your plan changes

A link never opens up because a plan changed. On Free, only the first link without a password, expiry, part, filters or embedding keeps working; the others are paused, and Settings › Sharing says so. A link with a password is never shown without it. Back on a plan with links, they work again by themselves. From Agency to a lower plan, the links stay and show Nvivio’s logo.

Built to be safe

• The link is the key: 32 random-looking characters (192 bits). Nvivio does not store it, only a hash of it, so a copy of our database opens nothing; the dashboard can show it to you again because it is made from the link’s id with a secret only the server has.
• A link reads only the numbers of its own site, through a short list of requests: everything else, for this site or any other, is not there for it. Tests try every request of the API with a link.
• Its reader cannot single out a visit: no fine filters, no “is not”, no group under 5 visitors, no window of a few seconds.
• A password is stored as PBKDF2-SHA-256 with a salt, never as you typed it. Five tries per minute per link and address, and at most 20 wrong ones per hour per link.
• Shared pages are never indexed (noindex), send no referrer, are never cached, and are framed only by the hosts you named.
• Requests through a link have a fair limit per link and address, and do not count towards your API limit.

API

Making and changing links is for a signed-in person, never an API key: a leaked key must not hand out access.

• GET /v1/sites/{site}/shares: the links, with url, state (active, expired or plan), last_opened_at and opens.
• POST /v1/sites/{site}/shares with name and optionally password, expires_at, part, filters, embed_hosts and layout (true, the default: your Overview).
• PATCH /v1/sites/{site}/shares/{id}: the same fields; null takes a password, expiry or part away.
• DELETE /v1/sites/{site}/shares/{id}: revoke.
• PUT /v1/orgs/{org}/brand with name and logo (a data: URL), DELETE to remove it.

A link reads with Authorization: Share <token>, the token from its address: GET /v1/share, then the numbers of its site, such as GET /v1/sites/{site}/stats. With a password, POST /v1/share/unlock with {"password": "…"} answers unlock; send Share <token>.<unlock> from then on. The OpenAPI description marks which requests a link may make.