Implement Secure Embedding with an Authorization Server in Bold BI

Overview

Bold BI’s secure embedding uses an Authorization Server — a backend endpoint in your application. This is the recommended production approach because it keeps sensitive tokens and secrets server-side, supports Row-Level Security (RLS), and prevents credential exposure in the browser.

The Bold BI JavaScript SDK calls your authorization endpoint, which adds user context (e.g., email) and a signature, then communicates with Bold BI to obtain a short-lived access token.

Info: This method is more secure than client-side token generation.

Step 1: Get Your Embed Secret Key

1. Log in to Bold BI as an administrator.
2. Click the Settings (gear icon) → Embed tab.

3. Enable Embed Authentication if not active.
4. Click Generate Secret (or copy an existing one).

Warning: Store the Embed Secret securely (e.g., environment variable or secret manager). Never expose it in client-side code.

Step 2: Configure Bold BI Embed SDK (Frontend)

<script src="https://cdn.boldbi.com/embedded-sdk/v15.4.0/boldbi-embed.js"></script>

function renderDashboard(dashboardId) {
    var dashboard = BoldBI.create({
        serverUrl: "https://your-boldbi-domain.com/bi/site/site1",  // Adjust for your site
        dashboardId: dashboardId,
        embedContainerId: "dashboard-container",
        embedType: BoldBI.EmbedType.Component,
        mode: BoldBI.Mode.View,
        width: "100%",
        height: "100%",
        expirationTime: 3600,  // Token validity in seconds
        authorizationServer: {
            url: "https://your-app.com/api/authorize"  // Your backend endpoint
        }
        // Optional: dashboardSettings, dataSourceFilters, etc.
    });

    dashboard.loadDashboard();
}

• The SDK sends a Post to your /api/authorize with query params like:

dashboard_id
dashboard_name
expiration_time
nonce
timestamp

Step 3: Build Your Authorization Endpoint (Backend)

• The Authorization Server acts as a secure bridge between the Bold BI Embed SDK (frontend) and Bold BI services.
  Flow Explanation
  When a user loads the embedded dashboard:

1. The Bold BI JavaScript SDK (frontend) sends a request to your backend:

    GET /api/authorize?dashboard_id=...×tamp=...&nonce=...
   

2. Your Authorization Endpoint (backend):

• Extracts the query string

• Identifies the logged-in user (e.g., email from session)

• Generates a secure signature (HMAC-SHA256) using:

  • Embed Secret Key
  • Query string

3. The backend then sends a POST request to Bold BI:

• Includes:

  • Query string
  • Generated signature
  • User email

4. Bold BI validates the request and returns:

{
 "access_token": "..."
} 

5. Your backend returns this token to the frontend

6. The SDK uses this token to securely load the dashboard

.NET / C# Snippet

public string GetSignatureUrl(string queryString)
       {
           if (queryString != null)
           {
               var encoding = new System.Text.UTF8Encoding();
               var keyBytes = encoding.GetBytes(GlobalAppSettings.EmbedDetails.EmbedSecret);
               var messageBytes = encoding.GetBytes(queryString);
               using (var hmacsha1 = new HMACSHA256(keyBytes))
               {
                   var hashMessage = hmacsha1.ComputeHash(messageBytes);
                   return Convert.ToBase64String(hashMessage);
               }
           }
           return string.Empty;
       }
   }
} 

Key Tips

• User email is mandatory — Bold BI checks permissions against it.
• Always pass the full query string as embedParameters.
• Signature uses HMAC-SHA256
• Test with Bold BI samples: https://github.com/boldbi (look for embedded-sdk or Node/React samples).
• For filters (dashboard params / URL filters): Append them to query string or use embed_datasource_filter.
• Errors like 400? Check payload, secret, or query string tampering.

Conclusion:

• Implementing a secure Authorization Server is the cornerstone of production-grade Bold BI embedding. It ensures tokens are generated safely on the server, supports advanced security features like RLS, and delivers a seamless analytics experience.

Additional References:

• Security Configuration - Authorization Server
• Embedding SDK Samples