How do I share an AI bot dashboard with a client without giving them an account?
Last updated · Written by the Bot Office team; it names Bot Office where it fits and says where it does not.
The short answer
Give each person or screen their own read-only link, not one shared link, so you can end one viewer's access without breaking everyone else's. Make each link expire when the engagement does, keep a list of who has which, and revoke a link the moment it leaks or the person moves on.
A link that grants access by itself is a "capability URL". The W3C's guidance on them recommends separate URLs for separate people and purposes, a way to revoke each, and care that the URL does not leak through referrer headers or third-party scripts. For people who use the dashboard every week, a login with a role is still better than a link.
Steps (with any tool)
- Decide who needs a login and who needs a link. Someone who decides or edits (an approver, a client admin) needs a login with a role. Someone who only watches (a client's team, a lobby TV, a board meeting) can have a read-only link.
- One link per viewer, with a name. "Acme lobby TV", "Dana (quarterly review)". A name tells you later whose access you are ending.
- Give each link an end date. A trial, a quarter, a contract term. A link with no end date tends to outlive the reason it was made.
- Keep the key out of logs and other sites. Put the secret part of the URL after the #: browsers never send that part to a server, so it stays out of server logs and referrer headers. Do not load third-party scripts on the page the link opens.
- Revoke one, or reset all. Revoke a single link when one viewer is done. If you are not sure where a link went, reset every link at once and hand out fresh ones.
How Bot Office does it
Every office has a public read-only link, plus up to five named share links: each has a name, an optional expiry (7, 30 or 90 days, or never) and its own Revoke, and revoking one leaves the others working. You make them in Mission Control's office settings or on the People page. "Rotate both keys" ends every link at once. Links are stored as hashes, the key sits after the # in the address, and the site loads no third-party scripts.
Give an office a short address such as aibotoffice.ai/o/acme to put in a proposal or an email signature. It holds no key: people who open it still sign in or use a link. For clients who approve actions or read the weekly report, invite them with a login and a role (viewer, member, approver or admin) on the People page instead (security explains what is stored).
Questions
Can a client see anything they shouldn't?
A share link is read-only: the office, its bots and their status. It cannot approve actions, change settings or see the access code.
What happens when a link expires?
It stops opening the office at once and shows as expired in the list until you revoke it.
Is it free?
Yes. Bot Office is free, with no card and no plan to pick (pricing).
Sources
Facts about other products are from their own documentation, linked above, as read on the date at the top. Bot Office is not certified or endorsed by their makers.