How to embed Tableau
into Embedportal.

1. Why this is needed

To embed Tableau views securely, you need to set up a Connected App in Tableau Cloud or Tableau Server. This enables JWT-based authentication, allowing Embedportal to generate trusted embed URLs for your Tableau content while Tableau continues to enforce your access controls and row-level security.

works with — Tableau Cloud, and Tableau Server 2021.1 or newer.

2. Prerequisites

• A Tableau Cloud site or Tableau Server 2021.1+ that you administer.
• A Tableau Site Admin account (Server Admin on Tableau Server). Connected Apps can only be created with admin permissions.
• An Embedportal workspace. Starter includes one BI integration; Professional and Enterprise include unlimited.
• About 30 minutes end-to-end.

3. Access Connected Apps Settings

1. 01

   Tableau Cloud

   Sign in as a Site Administrator. Go to Settings → Connected Apps.

2. 02

   Tableau Server

   Sign in as a Server or Site Administrator. Go to Settings → Connected Apps.

4. Create a New Connected App

1. 01

   Click New Connected App

   Open the button at the top of the Connected Apps list.

2. 02

   Connected app name

   Enter atSpark Integration as the Connected App name. This is the name Embedportal expects and it will appear in Tableau’s admin views.

3. 03

   Select Direct Trust

   This is the JWT-based authentication option. Embedportal signs short-lived tokens that Tableau trusts directly — no OAuth round-trip required.

4. 04

   Enable Allow access to REST API

   Turn on the toggle. Embedportal uses the REST API to fetch the list of views and workbooks you can embed.

5. Configure Domain Allowlist

Add your application domain to the Connected App’s allowlist. For example:

dev.atspark.com

This ensures Tableau content can only be embedded on your domain — not on someone else’s copy-paste of the snippet.

• Add the exact hostname you’ll embed from (no protocol, no path).
• If you’ve set a custom domain on a Professional or Enterprise plan, add that instead.
• Do not add wildcard domains or third-party URLs.

security — the allowlist is your line of defence against embed-jacking. Keep it strict.

6. Copy Connected App Credentials

After creating the Connected App, Tableau displays three values. Copy each one and paste it into the matching field in Embedportal’s Tableau connection form.

important — the Secret Value cannot be retrieved after the first reveal. If you close the dialog without saving, generate a new secret.

7. Enter Server Details

Provide your Tableau instance URLs. Embedportal collects them in two fields: Slug URL (the full Tableau server URL) and Content URL (your site slug).

Tableau Cloud

• Slug URL: https://yoursite.online.tableau.com — or your regional URL, for example https://prod-apnortheast-a.online.tableau.com.
• Content URL: yoursite — the slug that appears in your Tableau Cloud URL after /site/.

Tableau Server

• Slug URL: https://tableau.yourcompany.com — your internal Tableau Server domain.
• Content URL: yoursite — or leave blank for the default site.

8. Set Tableau Username

Enter the Tableau username (email address) that will be used for JWT authentication. In Embedportal this field is labeled Cloud User (Email Address). The user must have appropriate permissions to view the content you want to embed.

user@example.com

tip — use a service account username, not a personal account.

• Service accounts keep embeds working when employees leave or change roles.
• Audit logs stay clear — every embed session is attributed to one identifiable actor.
• Rotating a service-account password doesn’t break the embed; rotating the Connected App Secret Value does.

9. Fields you’ll fill in Embedportal

Bringing the whole setup together, the Embedportal connection form expects these six values:

Click Save & Test Connection. Embedportal will sign a test JWT, hit Tableau’s REST API, and show a green confirmation. You’re connected.

10. Register a dashboard

Each dashboard you want to surface is added as a navigation item in Embedportal. Open Navigation → Add dashboard and fill in:

• Dashboard name — the label viewers see in the sidebar of your portal.
• Description — optional note for your team.
• Tableau View URL — paste the view URL from Tableau; Embedportal parses the workbook and view name.
• Category — optional grouping, e.g. Revenue, Operations, Customers.
• Authentication mode — Authenticated or Anonymous.
• Enable RLS — available on Authenticated mode only.
• Status — toggle off to hide the dashboard without deleting the configuration.

Save. The dashboard is now embedded in your portal behind Embedportal’s auth and branding.

11. Authenticated vs Anonymous mode

Every dashboard is registered in one of two modes.

Authenticated

Viewers must be signed in to your portal. Embedportal signs the JWT with the viewer’s identity and any RLS claims they’re entitled to. Tableau filters the rows at query time.

Anonymous

No sign-in required. Embedportal still signs a JWT, but with no user identity and no RLS claims. Every viewer sees the same data. Use this for public product status pages, pitch decks, or aggregate marketing dashboards.

You can mix modes within the same portal — some dashboards authenticated, others public.

12. Row-level security

Turn one dashboard into per-viewer data. Embedportal forwards the viewer’s tenant, region, role or custom attributes as JWT claims; Tableau reads them via USERATTRIBUTE() on a data source filter and scopes the query automatically.

For the full setup with calculated-field formulas, see our dedicated guide: Row-level security for embedded dashboards.

13. Security best practices

• Use a dedicated service account with the minimum permissions required to view embedded content.
• Rotate Connected App secrets on a schedule — every 12 months is a reasonable default.
• Keep the domain allowlist strict. Only add domains you control.
• Monitor Connected App usage in Tableau’s admin views for unexpected traffic patterns.
• If a secret leaks, delete the Connected App in Tableau immediately and create a fresh one.

14. Troubleshooting

• Connection test fails with 401 — the Secret Value doesn’t match. Regenerate the secret in Tableau and paste the fresh values.
• Connection test fails with 403 — the Connected App is disabled, or the Tableau username doesn’t have permission to access the REST API.
• Dashboard loads blank inside the portal — the View URL slug is case-sensitive. Copy it exactly from Tableau.
• Dashboard shows all rows even though RLS is on — in Tableau, the RLS calculated field must be applied as a data source filter, not a view or dashboard filter.
• Users see “not authorised” — the service-account username in Embedportal doesn’t have access to the view. Grant the account project-level view permission.
• Embed works internally but not from a different domain — the domain isn’t on the Connected App’s allowlist. Add it.

15. FAQ