Iframe authentication

An iframe embed uses a signed URL as its browser credential. It does not use your Ridge API key or require your application to mint a JWT.

Generate a signed URL

Open the dashboard's Embed dialog in Ridge, choose Iframe Embed, and generate a URL. The URL contains an embed-token id and a signature tied to that dashboard.

<iframe src="SIGNED_RIDGE_EMBED_URL" title="Sales dashboard"></iframe>

Treat the complete URL as a bearer credential: anyone who has it can view the dashboard with the access encoded into that URL.

Lifecycle and revocation

The URL remains valid until you revoke it from the dashboard's Embed dialog. Revocation affects that credential without changing the dashboard or other generated URLs.

Use a separate URL when viewers need independently revocable access. Do not share one URL between customers merely because they view the same dashboard.

Row-level access

Choose the viewer's partition when generating the URL. The partition parameters are covered by the signature, so editing or removing them invalidates the credential.

See Partitioning for the security model and how it differs from an interactive dashboard filter.

Host origin

Displaying the iframe requires no host JavaScript. If the host will control it through postMessage, its origin must also be present in Ridge's iframe origin allowlist. Origin allowlisting controls who may send commands; the signed URL controls who may load data.