Embedding

Host-minted sessions

20–40 min

For customer-facing SaaS, mint a short-lived JWT from your backend after the host user authenticates. The browser only receives that JWT (≤15 minutes). Use Integrate → Embedding → Host-minted JWT to copy curl/Node samples filled with your workspace and resource ids, or mint a sample session to preview.

Why it matters

Modern embed products (Looker-style signed/cookieless sessions) avoid durable publish secrets in HTML.

When to use

  • Each customer or tenant should see different row filters.
  • You already authenticate users in your own app.

How to use

  1. Enable embedding on the dashboard or report.
  2. Open Integrate → Embedding → Host-minted JWT and set allowed origins plus optional rls_filters.
  3. Copy the backend mint sample (curl or Node) into your server.
  4. After your user signs in, call mint-embed-session, then render the iframe/SDK with the returned token and embed_domain.
  5. Optionally use Mint sample session in the UI to verify the live preview.

Success check: Your host app loads the embed with a short-lived token scoped to origins and locked filters.

Common mistakes

  • Minting JWTs from the browser in production — keep mint calls on your server.
  • Omitting origins or embed_domain so validation fails.
  • Relying only on URL params for tenant isolation instead of locked rls_filters.