Iframe embeds
Embed live Flax charts and dashboards in an iframe, framed only on allowlisted domains and scoped under row-level security
Iframe embeds render a live, interactive Flax chart or dashboard inside a page you control. This page is for developers placing embeds; set up tokens and the domain allowlist first in the embedding overview.
#Endpoints
An embed is a session-less page served from your Flax host:
GET /embed/chart/{id}
GET /embed/dashboard/{id}Point an iframe at the URL for the resource, carrying its embed token.
#Where it can load
Framing is controlled by a frame-ancestors content-security policy built from the embedding org's domain allowlist. Only origins on the allowlist may frame the page; the default is frame-ancestors 'none', which blocks all framing until you add a domain. The CSP is the authoritative control over where an embed appears.
#Data and access
The embed page fetches its data using the embed token, as the token's service principal. All results are scoped under row-level security and the token's entitlements — an embed never exposes more than its token can see.
Warning
If your iframe shows nothing, check that its host origin is on the org's embed domain allowlist. An origin that isn't listed is refused by the browser.