Inline authentication

An inline embed uses a short-lived JWT in the browser. Your server creates that JWT with a Ridge API key after authenticating its own user.

Mint a scoped JWT

Full request and response schemas for this endpoint are in the REST API reference.

POST https://app.ridgedata.ai/api/embed/token
Authorization: Bearer <YOUR_API_KEY>
Content-Type: application/json

{
  "dashboardIds": ["dashboard-id-123"]
}

The response is { "token": "<jwt>" }. Return it from your own authenticated endpoint, then pass it to RidgeEmbed.load in the browser.

Keep the API key on your server

An API key must never appear in browser code, page source, client logs, or a public build. Your server is responsible for deciding which dashboard and rows the current user may see.

Although dashboardIds is optional at the protocol level, production integrations should send it. A dashboard-scoped JWT cannot be reused to request a different dashboard.

Expiry

Embed JWTs expire after 24 hours and are not individually revocable. Mint one for a page load rather than caching it across users or sessions. A long-lived application should obtain a new token and remount before using an expired credential.

Row-level access

Add partitionFilters while minting the JWT to enforce row-level access. Derive partition values from the authenticated server session, never from an unchecked browser request.

See Partitioning for examples and the distinction between partitions and interactive filters.

Requirements

• The API key needs dashboard read access. Keys created for embedding get this by default.
• Embedding is a paid feature and is not available on the Free plan.