Shared Access
Shared Access lets you grant another person scoped access to your Monize accounts -- ideal for spouses, family members, accountants, or bookkeepers who need to view (and optionally update) parts of your financial data without sharing your password.
Each delegate has their own login. When they sign in, they can switch between their own data and yours using an always-visible banner at the top of the page.
- Concepts
- Adding a Delegate
- Configuring Delegate Permissions
- What the Delegate Sees
- Switching Context (Viewing Banner)
- Resetting a Delegate's Password
- Removing a Delegate
- Two-Factor Authentication and Delegation
- Security Notes
| Term | Meaning |
|---|---|
| Owner | The user who owns the accounts and grants access |
| Delegate | A separate user who has been granted access to one or more of the owner's accounts |
| Delegate-only user | A user account that was created by an owner via Shared Access and has never registered or claimed their own data |
| Acting as | The session state when a delegate is currently viewing an owner's data |
Delegates always have their own credentials. The owner's password is never shared, and the delegate sees only the data the owner has explicitly granted -- nothing else.
- Navigate to Settings > Shared Access
- Click Add delegate
- Enter the delegate's email address
Monize automatically looks up the email after a short delay. From there, one of three paths applies:
| Scenario | What you do | Result |
|---|---|---|
| Email already has a Monize account | Click Add delegate | The existing user gains access using their current login. No password or invite step. |
| New email, you set the password | Enter first/last name and a temporary password | A new user is created with that password. Share it with the delegate out-of-band; they can change it after logging in. |
| New email, send an email invite | Enter first/last name and check Send an email invite | A new user is created with no password. An invite email is sent containing a one-time link valid for 24 hours; the delegate sets their own password. |
Note: The password must meet Monize's standard complexity requirements (the same rules used for registration). Passwords are also checked against the Have I Been Pwned breach database.
After the delegate is created, they appear in the Shared Access list with zero accounts granted. The next step is to configure permissions.
From the delegate's row in the Shared Access list, click Edit access to open the permissions modal.
The modal has three tabs.
Choose which accounts the delegate can see, and what they can do with each.
Each account row has four checkboxes:
| Column | Meaning |
|---|---|
| Read | See the account, its balance, and its transactions |
| Create | Add new transactions to the account |
| Edit | Modify existing transactions in the account |
| Delete | Delete transactions from the account |
Read is required for Create, Edit, and Delete. Unchecking Read automatically clears the other three. If you grant no Read access at all, the delegate sees nothing for that account.
Accounts are grouped by type (Chequing, Savings, Credit Card, etc.) so you can scope access broadly -- for example, share all chequing accounts with your spouse while keeping investment accounts private.
Section toggles control whether the delegate can see entire feature areas of the application:
| Section | What it controls |
|---|---|
| Bills & Deposits | The scheduled / recurring transactions screen |
| Investments | Portfolio, securities, and investment transactions |
| Budgets | Budgets and budget tracking |
| Reports | All built-in and custom reports |
| AI Assistant | Natural-language queries via your configured AI provider |
A section is only useful if the delegate also has Read access to the accounts that feed it. For example, granting Reports without granting Read on any account produces empty reports.
AI Assistant note: The delegate uses your configured AI provider and consumes against your AI usage. Answers are scoped to the accounts the delegate can read.
Categories, payees, and tags are shared reference data across all of your accounts. This tab controls whether the delegate can modify them:
| Resource | Toggles |
|---|---|
| Payees | Create, Edit, Delete |
| Categories | Create, Edit, Delete |
| Tags | Create, Edit, Delete |
Read access to all three is always implied -- delegates need to see payees, categories, and tags to make sense of any transaction.
Tip: A common setup is to enable Create for all three but leave Edit and Delete off. This lets the delegate enter transactions naturally (creating new payees as needed) without being able to rename or remove existing entries that affect your historical data.
When the delegate logs in, their navigation is filtered to only the sections they have access to:
- The Accounts and Transactions tabs appear only if at least one account has Read enabled
- Bills & Deposits, Investments, Budgets, Reports, and AI appear only if the corresponding Section toggle is on
- Transactions involving an account the delegate cannot read display the inaccessible side as Hidden account in transfers
- The delegate can mark accounts as favourites independently of your own favourites -- their dashboard ordering does not affect yours
If a delegate has no personal Monize data (i.e., they were created via Shared Access and have not registered their own accounts), they go straight into your context after logging in.
While a delegate is viewing your data, an amber banner appears at the top of every page:
Viewing: [Owner Name] [ context switcher ]
The dropdown on the right lets the delegate switch between:
- Their own account (if they have one, labelled "(you)")
- Each owner who has shared access with them
Selecting a different context reloads the page so all data refreshes under the new identity.
Privacy: The banner is intentionally visible at all times. It guards against the delegate forgetting which dataset they are looking at and entering information into the wrong account.
If a delegate forgets their password, the owner can issue a new temporary password from the Shared Access list -- but only when the delegate is a delegate-only user.
- Open Settings > Shared Access
- Click Reset password on the delegate's row
- Copy the generated temporary password and share it with the delegate out-of-band
- The delegate logs in with the temporary password and can change it from their own Settings page
The Reset password button is hidden for delegates who:
- Have registered their own Monize account (they own their credentials -- you cannot overwrite them)
- Own financial accounts of their own
- Are also delegates for a different owner
- Have the admin role
In any of these cases, the delegate must use the standard Forgot Password flow on the login page.
- Open Settings > Shared Access
- Click Remove on the delegate's row
- Confirm the action
Removing a delegate immediately revokes all of their access:
- All per-account grants are deleted
- The delegate's favourite-account list (for your accounts) is removed
- If the delegate is currently signed in and viewing your data, their next request fails with "Delegated access is no longer valid" and they are logged out
If the delegate is a delegate-only user who has never created their own accounts and has no other delegations, their user record is also deleted. Otherwise the user remains (they keep their own login and any other delegations) -- only the relationship to your accounts is removed.
Note: Removing a delegate does not delete any transactions they created. Records keep their original creator attribution.
If you (the owner) have 2FA enabled, the delegate must also enable 2FA on their own account before they can act as you.
When a delegate tries to switch into an owner's context and the owner has 2FA but the delegate does not, the switch is blocked with:
"That account requires two-factor authentication. Set up 2FA in Settings before switching."
This is a non-negotiable requirement. TOTP secrets are per-user and are never shared between the owner and the delegate -- so the delegate must independently prove possession of a second factor for their own login before they can access a 2FA-protected dataset.
See Settings and Security > Two-Factor Authentication for setup details.
- Delegates never see your password, your 2FA secret, your backup codes, or your trusted-device list.
- Changing your password does not automatically revoke active delegate sessions -- if you need to cut off a delegate, use Remove on the Shared Access page.
- Delegate API requests are scoped server-side. Even if a delegate crafted a direct API call to an account they were not granted, the request would be rejected with a permission error.
- Invite tokens are stored as hashes and expire after 24 hours. A used token cannot be replayed.
- Reset tokens generated via Reset password are single-use and expire after the standard reset window.
- Personal Access Tokens (see Settings and Security > Personal Access Tokens) belong to the user that created them. A delegate's PAT does not grant access to the owner's data -- a delegate would need to switch context interactively and create the PAT while acting as the owner.