GitHub user Manglam44 created a discussion: Enable Superset Dashaboard Embedded and hide Edit Chart and More Option
### Bug description ### Summary We're trying to embed a Superset dashboard into our own web application using the Embedded SDK + guest token flow, but have run into multiple errors along the way and would appreciate a working step-by-step reference from the community, since the existing docs leave gaps for our setup. ### What we're trying to achieve - Embed a single dashboard (view-only) inside our own internal/client-facing app - No Superset login required for the end user — authenticated via guest token - Hide all edit/admin UI (Edit dashboard, chart edit menu, etc.) - Restrict embedding to specific approved domains only ### Steps we've followed so far 1. Enabled `EMBEDDED_SUPERSET` feature flag in `superset_config.py` 2. Generated an Embedded Dashboard UUID via dashboard "..." → Embed dashboard 3. Set up a backend service account to call `/api/v1/security/login` then `/api/v1/security/guest_token/` 4. Installed `@superset-ui/embedded-sdk` on the frontend and called `embedDashboard(...)` with `fetchGuestToken` pointing at our backend endpoint ### Errors encountered - <e.g. "Access denied" when loading `?standalone=2` directly> - <e.g. "This endpoint requires the datasource X, database or all_datasource_access permission"> - <e.g. CORS error when frontend calls guest_token endpoint> - <e.g. iframe stays blank / fails silently with no console error> ### What we've already tried - Verified `EMBEDDED_SUPERSET` flag is set and Superset restarted - Granted `all_datasource_access` and dashboard-level role access - Confirmed the guest token is being generated (valid JWT, correct `resources` scope) - Tried both with and without `standalone=2` in the URL ### Question Could someone share a confirmed-working, current step-by-step flow (or point to an up-to-date example repo) for: 1. Correct `superset_config.py` settings required for embedding (feature flag, CORS, GUEST_TOKEN settings, TALISMAN/CSP if relevant) 2. The exact guest token payload structure expected for the current version 3. Correct frontend SDK usage/version compatibility 4. Common causes of "Access denied" / blank iframe when everything above appears correctly configured **Happy to share our full config and error logs in the thread. Thanks in advance — this seems like a common ask so a clear answer here would likely help others too.** ### Screenshots/recordings _No response_ ### Superset version master / latest-dev ### Python version 3.11 ### Node version 16 ### Browser Chrome ### Additional context _No response_ ### Checklist - [x] I have searched Superset docs and Slack and didn't find a solution to my problem. - [x] I have searched the GitHub issue tracker and didn't find a similar bug report. - [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section. GitHub link: https://github.com/apache/superset/discussions/42758 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
