Understanding the Difference Between JWT Token and Access Token in Bold BI.

Bold BI offers robust, enterprise-grade security for authentication, authorization, and secure dashboard embedding. Two key token types frequently discussed are the JSON Web Token (JWT) and the access token (commonly referred to as the embed token in embedding scenarios).

While OAuth access tokens used in token-based embedding may be JWT-formatted, Bold BI also supports signature-based embedding using an Embed Secret.

Authorization Options

• JWT is primarily for Single Sign-On (SSO) to authenticate users into the full Bold BI application.
• Access/Embed Token is for secure, scoped dashboard embedding and REST API access.

This distinction is crucial for developers and admins designing integrations, whether for full application SSO or isolated embedded analytics.

JWT Token Overview

JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting data as a compact JSON object.
It consists of three Base64URL-encoded parts: (Structure: header.payload.signature.)

1. Header: Algorithm and token type.
2. Payload: Claims (e.g., user ID, email, exp, iss, custom data).
3. Signature: Ensures integrity and authenticity.

Key benefits: Stateless, tamper-proof, compact, supports expiration, ideal for distributed systems, APIs, and SSO.

Use Cases in Bold BI

• Single Sign-On (SSO):
  Enables passwordless authentication. External app generates signed JWT with user details, redirects to Bold BI callback URL. Bold BI validates token, logs in user (or auto-provisions).
• Dashboard Embedding:
  Securely embeds dashboards in external apps via iFrame or JavaScript. JWT provides seamless auto-login, supports row-level security and multi-tenancy.
• Data Source Authentication:
  Used in web data connectors for APIs requiring bearer tokens (e.g., REST/OData). JWT generated dynamically and passed for authenticated data access.
• API Security:
  Authenticates programmatic access to Bold BI REST APIs using short-lived JWTs.

Access Token Overview

• Access Token in Bold BI is a short-lived OAuth 2.0 bearer token (60 minutes by default; token lifetime can be scoped shorter for embedding scenarios) used for secure API authentication. Generated via the /token endpoint using credentials like client_id, client_secret, grant_type (for e.g., client_credentials, password), username, or embed_secret (for SSO users). Included in requests as Authorization: Bearer {token}.

Key benefits: User-specific permissions, revocable, no password exposure, ideal for server-side and programmatic access.

Use Cases in Bold BI

REST API Authentication:

• Authenticates all Bold BI REST API calls (e.g., managing dashboards, users, data sources).
  Dashboard Embedding:
• Enables token-based embedding (server-side/auth) in web apps (JavaScript/React/Angular). Server generates token and passes to client for secure, seamless rendering with row-level security (RLS) and multi-tenancy support.
  SSO/External Auth Integration:
• Uses embed_secret + username to generate tokens for users authenticated via Azure AD, JWT, or OpenID, avoiding stored passwords.
  Data Source Connections:
• Handles OAuth2 token generation/refresh in web data connectors; stores and dynamically passes tokens for authenticated API access.

When to Use Which?

• Use JWT when implementing custom SSO for the entire Bold BI application. Ideal for scenarios where users log in via your existing identity system and access the full Bold BI UI.
• Use Access/Embed Token for embedding isolated dashboards into your application (e.g., SaaS portals). This provides finer control, supports RLS, and avoids exposing the full Bold BI interface.
• Combination: In many setups, JWT handles initial user authentication, while embed tokens secure the actual dashboard rendering.

Security Considerations

Always generate tokens server-side to avoid exposing secrets.

• Use HTTPS for all token transmissions.
• For JWT: Enable encryption in Bold BI settings for sensitive payloads.
• For embed tokens: Rotate embed secrets periodically and use the embed secret method for non-local users.
• Never pass embed_secret, client_secret, or access tokens to browser/client-side code - all token generation must happen server-side (state this explicitly under token-based embedding).
• Prefer embed_secret or client_credentials grants over the password grant wherever possible, to avoid password exposure.

Conclusion

• In Bold BI, the JWT token and access/embed token complement each other but address different layers of security: JWT excels at authentication for SSO, while the access token handles authorization for embedding and APIs. Understanding this distinction helps in designing secure, scalable integrations.
• This clarity ensures your Bold BI deployments are both user-friendly and highly secure. If you’re setting up a new integration, start with the embedding method that matches your user experience goals.

Additional Reference:

• Security Configuration - SSO - JSON Web Token.
• Embedding SDK - Authorization Options.
• Token Generation