Guides → Embed Dashboards in External Websites

Overview

Incorta supports embedding dashboards in external web applications, portals, and tools using an HTML <iframe> element. You can embed a dashboard with full Incorta authentication, using Single Sign-On (SSO), using a JWT-based token, or by generating a publicly shareable link that requires no sign-in at all. Each approach addresses a different security posture and audience.

Here are the high-level steps to embed an Incorta dashboard in an external website:

Configure Incorta to allow iframe inclusion from external origins.
Select an authentication method appropriate for your deployment.
Construct the iframe URL and add it to your application.
Verify the embedded dashboard renders correctly.

Prerequisites: Before you start…

Ensure that your external application is hosted at a trusted origin that your network and browser security policies permit to load content from Incorta.
You will need the dashboard GUID. You can find it in the dashboard URL (for example, https://<HOST>/incorta/#/dashboard/a36b1474-060f-423d-987e-c164972ea5e4).

Step 1: Enable iframe inclusion in the CMC

This step is required for all embedding approaches that serve the dashboard from a domain different from your Incorta host. By default, Incorta returns the x-frame-options: SAMEORIGIN HTTP security header, which prevents the platform from loading inside an iframe on a different domain. You must enable iframe inclusion in the CMC before any cross-origin embedding will work.

Sign in to the Cluster Management Console (CMC).
Navigate to Clusters > <your-cluster> > Cluster Configurations > Server Configurations > Security.
Enable the Enable Iframe Inclusion toggle.
Select Save.

Important

Enabling iframe inclusion removes the x-frame-options: SAMEORIGIN response header globally. Incorta can then be embedded from any external origin. Restrict access at the network and authentication layer to control who can reach the embedded dashboard.

Step 2: Select an authentication method

Incorta supports four approaches for handling authentication in an embedded dashboard. Select the approach that matches your security requirements.

Method	Best for	Requires Incorta user account
Incorta login	On-Premises integrations where SSO is not available	Yes, preferably, a dedicated view-only account
SSO pass-through	Enterprise portals where both the host application and Incorta share an identity provider (for example, Okta)	Yes, provisioned via SSO
JWT authentication	Internal portals and partner applications using OAuth 2.0	Yes, mapped by JWT claim
Publicly shared dashboard	Public-facing websites and anonymous consumers; no sign-in required	No

No preparation steps apart from the iframe inclusion are required. Add the iframe to your HTML page using the following format:

<iframe
  src="http://<HOST>:<PORT>/incorta/#/dashboard/<DASHBOARD_GUID>"
</iframe>

Notes

Replace <HOST>, <PORT>, and <DASHBOARD_GUID> with the appropriate values for your environment.

The viewer will be prompted to sign in. A user account with at least View access to the dashboard is required.

Passing dashboard filters via URL

You can pass filter parameters to the dashboard through the URL. Append a params argument to the iframe’s src value in the following format:

/incorta/#/dashboard/<DASHBOARD_GUID>/params?filters=[{"field":"<SCHEMA.TABLE.COLUMN>","operator":"=","values":["<VALUE>"]}]

SSO pass-through

SSO pass-through is the recommended approach when both your host application and Incorta authenticate through the same identity provider (IdP). The browser session that signs in to the host application is also valid in the embedded Incorta iframe. No additional credentials are required.

Here are the required steps:

Confirm that both your host application and your Incorta tenant use the same ID provider (for example, Okta or Azure Active Directory).
In the CMC, configure Incorta's SSO settings under Tenant Configurations > Security > Authentication Type > SSO.
Add the iframe to your application using the dashboard URL:

<iframe
  src="https://<HOST>/incorta/#/dashboard/<DASHBOARD_GUID>"
</iframe>

JWT authentication

JWT-based embedding secures the iframe using a signed OAuth 2.0 JSON Web Token (JWT). Incorta validates the token on each request and maps the token's user claim to an Incorta account. This approach is available starting 2026.3.0.

Here are the steps to configure JWT-based embedding:

After enabling the iframe inclusion, in Server Configurations > Security, turn on Enable Embedded Dashboard JWT, and configure the required properties, including the issuer and audience claim. For details, refer to Guides → Configure Server > Security.

Configuration property	Description
Embedded Dashboard JWT Issuer	Enter the value that must match the `iss` claim in the JWT.
Embedded Dashboard JWT Audience	Enter the value that must match the `aud` claim in the JWT.
Embedded Dashboard JWT User Claim Name	Enter the claim that contains the Incorta username (for example, `sub` or `email`).
Embedded Dashboard Disable JWT Signature Validation	Turn on this toggle to disable token signature validation in case a symmetric algorithm is used for token signing and validate JWT tokens using the issuer and audience claim instead.
Embedded Dashboard JWT Audience	Enter the expected audience claim (`aud`) to validate against the JWT token issued by the OAuth 2.0 authorization server. This option is available when you turn on the Embedded Dashboard Disable JWT Signature Validation toggle. You can add multiple audiences as a comma-separated list.

In your ID provider, generate a signed JWT token that includes the iss, aud, and user claim values you configured.
Add the iframe as follows:

Embed a full dashboard:

<iframe
  src="https://<HOST>/incorta/embed/dashboard?tenant=<TENANT>&dashboardGUID=<DASHBOARD_GUID>&token=<JWT_TOKEN>"
  width="100%"
  height="900">
</iframe>

Embed a single insight within a dashboard:

<iframe src="https://<HOST>/incorta/embed/dashboard?tenant=<TENANT>&dashboardGUID=<DASHBOARD_GUID>&insightId=<INSIGHT_ID>&token=<JWT_TOKEN>"
</iframe>

Embed query parameters:

Parameter	Required	Description
`tenant`	Yes	Incorta tenant name. Note that tenant names are case-sensitive.
`dashboardGUID`	Yes	The dashboard identifier from the dashboard URL
`insightId`	No	The identifier of a specific insight to display within the dashboard
`token`	Yes	The signed JWT to be used for authentication and authorization.

Recommendation

JWT-based embedding is the recommended approach for internal portals and partner applications. It avoids transmitting Incorta credentials and enables access control at the token level. Rotate tokens regularly and set appropriate expiry claims.

Publicly shared dashboards

Starting with the 2025.7.1 release, Incorta supports generating a public sharing link or iframe snippet for a dashboard. The link allows read-only access to that specific dashboard without requiring the viewer to sign in to Incorta. This enables dashboard distribution to external audiences, public-facing websites, and non-Incorta users.

Warning

A publicly shared dashboard link is accessible to anyone who has the URL. Do not publish dashboards that contain confidential, personally identifiable, or otherwise sensitive data using public sharing.

Here are the steps to enable the dashboard public sharing feature.

Sign in to the Cluster Management Console (CMC).
Navigate to Clusters > <your-cluster> > Cluster Configurations > Server Configurations > Security.
Turn on the Enable Public Share feature toggle.
Select Save.

Notes

Ensure that the Disable all public share links toggle is off.
Ensure that the Enable Iframe inclusion toggle is on when sharing dashboards and insights as embedded iframes.
For Incorta Cloud clusters, contact the Support team to enable and configure the feature.

For details about generating a dashboard public link, refer to Tools → Dashboard Manager > Share dashboards publicly.

Important

It is highly recommended to use a shortened link to access the dashboard instead of the full dashboard URL. This helps prevent access issues, particularly when the host application encodes links, which can lead to link corruption. You can use tools such as TinyURL or Bitly to get a shortened link.

Capability	Supported
Full dashboard view	✔
Navigate between dashboard tabs	✔
Dashboard runtime filters	✔
Apply dashboard prompts	✔
Dashboard drilldown	No
View a single insight only	No
Password-protected links	No

Notes

Only the dashboard owner can generate a public sharing link.
If you unpublish a dashboard and republish it, a new link is created.
When deleting a dashboard owner's account, a list of publicly shared dashboards is displayed before deleting them with the owner’s account.
When deactivating the owner’s account, all publicly shared links are revoked automatically.

Step 3: Construct the iframe and add it to your application

After selecting and configuring your authentication method, place the iframe element in your application's HTML where you want the dashboard to appear. Note that the supported iframe code varies according to the selected authentication method.

Use the following guidelines for sizing and layout:

Full-height, full-width layout

<iframe
  src="<INCORTA_DASHBOARD_URL>"
  style="height:100vh;width:100%;border:none;">
</iframe>

Fixed-size layout

<iframe
  src="<INCORTA_DASHBOARD_URL>"
  width="100%"
  height="900"
  style="border:none;">
</iframe>

Verify the embedded dashboard

After adding the iframe to your application, verify the following:

The dashboard loads without a sign-in prompt (for SSO, JWT, and public sharing methods).
Dashboard insights render and display data correctly.
Tab navigation functions as expected.

If the iframe displays a blank page or a sign-in screen, confirm that iframe inclusion is enabled in the CMC and that the embedding user or token has View access to the target dashboard.