# Iframe embeds

> Embed live Flax charts and dashboards in an iframe, framed only on allowlisted domains and scoped under row-level security

*[View this page in the Flax docs](https://flax-analytics.com/docs/developers/embed-iframe)*

Iframe embeds render a live, interactive Flax chart or dashboard inside a page you control. This page is for developers placing embeds; set up tokens and the domain allowlist first in the [embedding overview](/docs/developers/embedding-overview).

## Endpoints

An embed is a session-less page served from your Flax host:

```http
GET /embed/chart/{id}
GET /embed/dashboard/{id}
```

Point an iframe at the URL for the resource, carrying its [embed token](/docs/developers/embedding-overview).

## Where it can load

Framing is controlled by a **`frame-ancestors` content-security policy** built from the embedding org's domain allowlist. Only origins on the allowlist may frame the page; the default is `frame-ancestors 'none'`, which blocks all framing until you add a domain. The CSP is the authoritative control over where an embed appears.

## Data and access

The embed page fetches its data using the embed token, as the token's service principal. All results are scoped under [row-level security](/docs/modeling/row-access-filters) and the token's entitlements — an embed never exposes more than its token can see.

> [!WARNING]
> If your iframe shows nothing, check that its host origin is on the org's embed domain allowlist. An origin that isn't listed is refused by the browser.

## Related

- [Embedding overview](/docs/developers/embedding-overview)
- [Static PNG embeds](/docs/developers/embed-png)
- [Row access filters](/docs/modeling/row-access-filters)