What needs a token and what doesn't
Everyone your Plex server knows, friends included.
PULL (into Kustos) needs nothing per-person. Watch history, cleanup protection and who's-watched-what work for everyone with no token at all — Kustos reads on the admin token, the same basis Tautulli uses. Kustos pulls history for whoever actually has plays, so the account count on the page is an upper bound rather than a promise.
PUSH (out as a person) needs that person's own Plex token. Turning their watchlist into requests, or writing Kustos's merged history back into Plex for them — which is how you'd restore progress after a rebuild, and it works even for people who never used Trakt.
ABSORB folds a replaced account's old history into the current account, so a cleanup rule names the person once. An account can only be absorbed by one person.
The write-out switches, one per destination
Kustos always pulls this person's history in. The switches on their card control only what Kustos writes back out, and there is one per destination. They are independent — turning one on never turns on another.
| Switch | What it writes |
|---|---|
| Push to Plex | Writes Kustos's merged history back into Plex as that person. This is what restores their progress after a rebuild, and it works for people who never used Trakt. Needs their Plex token. |
| Push to Trakt | Writes Kustos's merged history for this person out to their Trakt account. |
| Push to Simkl | Sends the merged history to their Simkl on a schedule. Separate from the Trakt switch. |
Push to Plex and Push to Trakt run on the Trakt sync task, and Push to Simkl on the Simkl push task, both every 6 hours by default.
Both ways is both switches. Somebody who watches on Trakt and wants Plex to catch up needs Push to Plex; somebody who watches in Plex and wants Trakt to know needs Push to Trakt. Turn both on and their watches travel in both directions. There is no separate two-way control, because there is nothing left for it to decide.
"Pull from Plex / Tautulli / Trakt / Simkl" is not a switch. Kustos always reads every linked account's history in — those cells are there to say so, and they cannot be turned off. Tautulli's is always on in the same way Plex's is. Only the writing out is yours to choose.
If you used Kustos before 28 September 2026, check this card. Until then Push to Plex did nothing on its own — only the old two-way switch actually wrote into Plex, so the Push to Plex toggle could read as on while nothing was ever marked. The upgrade turns it off for anyone who was in that state, rather than silently starting to stamp watched history across their library. Turn it on when you mean it.
Tokens, and the two buttons that manage them
| Control | What it does |
|---|---|
| Fetch Plex tokens | Grabs a token for every no-PIN Home user using your admin token. Re-run any time one goes stale. |
| + Plex token | Only needed for a user outside your Plex Home. Home users are covered by your server's own account, so they never need one. For anyone else, it lets Kustos pull and sync that user's own Plex data. |
| Remove a token | Kustos can no longer write back to Plex as them. Their history still pulls in, because pulling never needed a token. |
A card saying a token no longer authenticates means exactly that: paste a fresh one, or re-run Fetch for a Home user.
Watchlist mode — "off it once they start"
Once somebody has started something it comes off their watchlist, on the reasoning that a watchlist is for things you have not seen yet. It applies to the services set to Append or Sync.
Hiding a person
Hiding needs no token and takes nothing away: it is display-only, and a hidden person's watch history still protects their titles. See hide somebody without breaking protection.
Hide Guest is its own switch: it hides the shared Plex "Guest" account everywhere on the page, since it is not a person and usually only adds noise.