Public links

Share a read-only snapshot of a board with anyone through a secret link, after turning on the allow public links setting.

A public link lets someone see a board without a WordPress account. It is read-only and off by default.

Turn the feature on

  1. Go to the KanbanWP settings and open the General tab.
  2. Check Allow boards to be shared via public links.
  3. Save the settings.

While the setting is off, every public link is rejected, even one that was created earlier. See general settings.

Each board can have one secret token. The public address is your home URL with two query parameters, kanbanwp_board (the board ID) and kwp_token (the token). Anyone with the full address can open it. The token is a random 32-character string and it is compared securely.

The same token also works on a page that holds the [kanbanwp_board] shortcode, by adding ?kwp_token=... to that page’s address.

What the visitor sees

The link opens a simple page that loads a snapshot of the board:

  • The board name and description.
  • Stages, in order.
  • Tasks, with title, description, priority, due date and labels.
  • Labels and the list of members with their roles.

Visitors can’t change anything, and they can’t comment. Internal-only tasks are left out. Assignees, checklists, attachments, comments and custom fields are not included. The page is marked noindex so search engines are asked not to list it.

Tokens are managed through the REST API at /wp-json/kanbanwp/v1/portal/token, and need the board admin role.

  • POST with board_id generates a new token and returns the public URL. Generating again replaces the old token, so older links stop working.
  • POST with board_id and revoke set to true removes the token.
  • GET with board_id tells you whether a token exists and returns its URL.

The Settings screens and board UI don’t offer a button for this. See the REST API.

A visitor sees “This shared board link is invalid or has been disabled” when the setting is off, the board no longer exists or the token was revoked or replaced.

Security notes

Anyone who has the link can view the data above, so treat it like a password. Revoke it when the project ends, and never put private information on a board you share this way. For people who need to comment, use the client portal.

Last updated October 13, 2026