Enable Superset Dashaboard Embedded and hide Edit Chart and More Option

[Manglam44]

Bug description

Summary

We're trying to embed a Superset dashboard into our own web application using the
Embedded SDK + guest token flow, but have run into multiple errors along the way and
would appreciate a working step-by-step reference from the community, since the
existing docs leave gaps for our setup.

What we're trying to achieve

• Embed a single dashboard (view-only) inside our own internal/client-facing app
• No Superset login required for the end user — authenticated via guest token
• Hide all edit/admin UI (Edit dashboard, chart edit menu, etc.)
• Restrict embedding to specific approved domains only

Steps we've followed so far

1. Enabled EMBEDDED_SUPERSET feature flag in superset_config.py
2. Generated an Embedded Dashboard UUID via dashboard "..." → Embed dashboard
3. Set up a backend service account to call /api/v1/security/login then
   /api/v1/security/guest_token/
4. Installed @superset-ui/embedded-sdk on the frontend and called embedDashboard(...)
   with fetchGuestToken pointing at our backend endpoint

Errors encountered

• <e.g. "Access denied" when loading ?standalone=2 directly>
• <e.g. "This endpoint requires the datasource X, database or all_datasource_access permission">
• <e.g. CORS error when frontend calls guest_token endpoint>
• <e.g. iframe stays blank / fails silently with no console error>

What we've already tried

• Verified EMBEDDED_SUPERSET flag is set and Superset restarted
• Granted all_datasource_access and dashboard-level role access
• Confirmed the guest token is being generated (valid JWT, correct resources scope)
• Tried both with and without standalone=2 in the URL

Question

Could someone share a confirmed-working, current step-by-step flow (or point to an
up-to-date example repo) for:

1. Correct superset_config.py settings required for embedding (feature flag, CORS,
   GUEST_TOKEN settings, TALISMAN/CSP if relevant)
2. The exact guest token payload structure expected for the current version
3. Correct frontend SDK usage/version compatibility
4. Common causes of "Access denied" / blank iframe when everything above appears
   correctly configured

Happy to share our full config and error logs in the thread. Thanks in advance —
this seems like a common ask so a clear answer here would likely help others too.

Screenshots/recordings

No response

Superset version

master / latest-dev

Python version

3.11

Node version

16

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot[bot]]

Hi @Manglam44! I'm Dosu and I'm helping the Apache Superset team.

Here's a consolidated step-by-step reference for embedding a Superset dashboard with the guest token flow:

1. superset_config.py settings

FEATURE_FLAGS = {
    "EMBEDDED_SUPERSET": True,
}

# Guest token config — change the secret in production!
GUEST_TOKEN_JWT_SECRET = "your-strong-secret-here"  # generate with: openssl rand -base64 42
GUEST_TOKEN_JWT_EXP_SECONDS = 300  # 5 min, SDK auto-refreshes
GUEST_ROLE_NAME = "Public"         # FAB role assigned to every guest user

# CSP — allow your app domain to iframe Superset
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
    "content_security_policy": {
        "default-src": ["'self'"],
        "frame-ancestors": ["'self'", "https://your-app-domain.com"],
        "img-src": ["'self'", "blob:", "data:"],
        "worker-src": ["'self'", "blob:"],
        "connect-src": ["'self'"],
        "object-src": "'none'",
        "style-src": ["'self'", "'unsafe-inline'"],
        "script-src": ["'self'", "'strict-dynamic'"],
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,  # False if TLS is terminated by a reverse proxy
    "session_cookie_secure": True,
}

# Cross-origin cookie settings for embedding
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True

# If behind a reverse proxy
ENABLE_PROXY_FIX = True

[1] [2]

2. Enable embedding on the dashboard

In the Superset UI: open the dashboard → "…" menu → Embed Dashboard → add your allowed domains. This creates an EmbeddedDashboard record with a UUID. An empty domain list means any origin can embed [3].

3. Guest token payload structure

Your backend calls POST /api/v1/security/guest_token/ with a valid admin/service-account bearer token [4]:

{
  "user": { "username": "guest_user", "first_name": "Guest", "last_name": "User" },
  "resources": [{ "type": "dashboard", "id": "<embedded-dashboard-uuid>" }],
  "rls": []
}

The resources.id should be the embedded UUID (not the dashboard integer ID). The user.username should be non-empty. The response returns a token field containing the JWT.

4. Frontend SDK usage

npm install @superset-ui/embedded-sdk

import { embedDashboard } from "@superset-ui/embedded-sdk";

embedDashboard({
  id: "embedded-dashboard-uuid",        // from the Embed Dashboard dialog
  supersetDomain: "https://superset.example.com",
  mountPoint: document.getElementById("dashboard-container"),
  fetchGuestToken: () =>
    fetch("/your-backend/guest-token")
      .then(r => r.json())
      .then(d => d.token),
  dashboardUiConfig: {
    hideTitle: true,
    hideChartControls: true,   // hides the "..." menu and edit controls on charts
    hideTab: false,
  },
});

The hideChartControls: true option hides the chart-level "Edit chart" and "More options" ("…") menus — this is the setting you need to remove edit/admin UI [5].

5. Common causes of "Access denied" / blank iframe

• Missing can read on CurrentUserRestApi permission on the guest role. The embedded frontend calls /api/v1/me/roles/ on load — if this returns 403, the iframe stays blank. Add this permission to your GUEST_ROLE_NAME role [6].
• Missing dataset-level permissions. The guest role needs datasource access on every dataset used by the dashboard's charts, not just dashboard-level access.
• CORS errors on guest token call. CORS only applies if your browser directly calls Superset's API. The guest token should be fetched by your backend (server-to-server), not the browser. The fetchGuestToken callback should call your backend, which then calls Superset.
• CSP frame-ancestors not set. Without this, browsers block the iframe silently.
• SESSION_COOKIE_SAMESITE still at default "Lax". Cross-origin iframes need "None" + Secure.
• Referer header mismatch. The /embedded/<uuid> route validates Referer against the allowed_domains list — a mismatch returns 403 [7].
• Using ?standalone=2 instead of the SDK. The standalone param strips UI chrome but does not handle guest token auth. Use the embedded SDK for the guest token flow; standalone is for authenticated users only [8].

Feel free to share your specific error logs and config — happy to help narrow down the exact issue you're hitting.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[dosubot[bot]]

@Manglam44 — here's a consolidated reference for the full embedding flow:

1. superset_config.py settings

FEATURE_FLAGS = {
    "EMBEDDED_SUPERSET": True,
}

# Guest token — change the secret in production
GUEST_TOKEN_JWT_SECRET = "your-strong-secret-here"
GUEST_TOKEN_JWT_EXP_SECONDS = 300       # SDK auto-refreshes before expiry
GUEST_ROLE_NAME = "Public"

# CSP — allow your app to iframe Superset
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
    "content_security_policy": {
        "default-src": ["'self'"],
        "frame-ancestors": ["'self'", "https://your-app-domain.com"],
        "img-src": ["'self'", "blob:", "data:"],
        "worker-src": ["'self'", "blob:"],
        "connect-src": ["'self'"],
        "object-src": "'none'",
        "style-src": ["'self'", "'unsafe-inline'"],
        "script-src": ["'self'", "'strict-dynamic'"],
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,         # False when TLS is terminated at a reverse proxy
    "session_cookie_secure": True,
}

# Cross-origin cookie settings (required for iframe embedding)
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True

# If behind a reverse proxy
ENABLE_PROXY_FIX = True

[1] [2]

2. Enable embedding on the dashboard

Dashboard → "…" menu → Embed Dashboard → add your allowed domains (comma-separated). An empty list means any origin can embed [3].

3. Guest token request payload

Your backend (not the browser) calls POST /api/v1/security/guest_token/ with a service-account bearer token [4]:

{
  "user": { "username": "guest_user", "first_name": "Guest", "last_name": "User" },
  "resources": [{ "type": "dashboard", "id": "<embedded-dashboard-uuid>" }],
  "rls": []
}

Use the embedded UUID (from the Embed Dashboard dialog), not the dashboard's integer ID.

4. Frontend SDK usage

npm install @superset-ui/embedded-sdk

import { embedDashboard } from "@superset-ui/embedded-sdk";

embedDashboard({
  id: "embedded-dashboard-uuid",
  supersetDomain: "https://superset.example.com",
  mountPoint: document.getElementById("dashboard-container"),
  fetchGuestToken: () =>
    fetch("/your-backend/guest-token")
      .then(r => r.json())
      .then(d => d.token),
  dashboardUiConfig: {
    hideTitle: true,
    hideChartControls: true,   // hides "Edit chart" and the "..." menu on charts
    hideTab: false,
  },
});

hideChartControls: true is the key setting that removes the edit/admin UI elements you want hidden [5].

5. Common causes of "Access denied" / blank iframe

• Missing permissions on the guest role — The embedded frontend calls GET /api/v1/me/roles/ on load. If the role configured in GUEST_ROLE_NAME (default Public) doesn't have the can read on CurrentUserRestApi permission, the iframe stays blank. Also ensure the role has datasource access on every dataset used by the dashboard's charts.
• CORS errors — The guest token endpoint should be called server-to-server from your backend, not directly from the browser. Your fetchGuestToken callback should call your backend, which proxies to Superset.
• CSP frame-ancestors not set — Without this directive, browsers silently block the iframe [6].
• SESSION_COOKIE_SAMESITE still at default "Lax" — Cross-origin iframes require "None" + Secure.
• Referer mismatch — The /embedded/<uuid> route validates the Referer header against the allowed domains list and returns 403 on mismatch [7].
• Using ?standalone=2 instead of the SDK — The standalone param only strips UI chrome; it does not handle guest token auth. Use the embedded SDK for unauthenticated embedding [8].

Feel free to share your specific error logs and config — happy to help narrow down the exact issue you're hitting.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.