This opens a second port meant to be reached from outside your network. It serves a locked-down view: live service status and (optionally) content requests. It never exposes your API keys, passwords, or internal addresses.
- It is protected only by the access token you set. That token is a shared secret, so anyone who has it can use the endpoint.
- The token is sent with each request, so on plain HTTP it could be intercepted. You should serve it over HTTPS.
- Strongly recommended: put this port behind a reverse proxy that adds its own login and HTTPS, such as Authelia, Authentik, Cloudflare Access, or Caddy/Nginx (NPM) basic auth. Do not forward the raw port straight to the internet.
- Use a long, random token (the Generate button makes one), and leave Allow content requests off unless you need it.
The public port only starts after you save and restart GuardTowarr.