An extended public key allows to generate all receive addresses associated with your wallet and therefore, it is highly sensitive from a privacy perspective. An extended public key does not allow you to make transactions, only to view your wallet addresses & transaction history.

If you want to unpack a little bit more on what an xpub is and how to display it on our BitBoxApp please have a read here: Where can I find my extended public keys?

Bear in mind you should be cautious of how you are exporting your extended public keys. Anyone with access to it can view your wallet transaction prior and future history/balance. 

Using a safe computer and trustworthy wallet is of utmost importance.

Attention: By default the BitBoxApp uses "unified accounts" with the BitBox02 which means that the Bitcoin account consists of three address types (wrapped-segwit, native-segwit and taproot), all of which have a separate extended public keys. 

All extended public keys are displayed in the account information section in the BitBoxApp (if you only see 2x, then please update your BitBox02 firmware). 
This means that if you want to create a watch-only wallet you might have to create three separate watch-only wallets in order to see your full transaction history/wallet balance. However, be aware that the extended public key for Taproot addresses starts with xpub.... exactly like the extended public key for Legacy addresses. This means that most watch-only wallets will import it as a Legacy extended public key and therefore your transactions sent to Taproot addresses will not show up. We are currently not aware of any watch-only wallet that lets you specify that an extended public key starting with xpub... is a Taproot extended public key instead of a Legacy extended public key