Sharing & embeds

The Share button on the dashboard canvas covers every way a dashboard reaches people: public links, embeds in your own apps, scheduled email delivery, and per-user access inside the workspace.

Share links

Generate a public link (/s/<token>) — anyone with the link can view. Two protections, both optional:

• Password — visitors are prompted before anything renders.
• Expiration — pick a date and the link stops working after it.

What a link visitor gets

The dashboard exactly as authored, read-only and live: they can use filter cards, cross-filter by clicking chart points, and set parameters if the author defined them. Drill-through to other dashboards is disabled (the target isn’t shared). Shared reports render read-only with their promptable filters.

Within the workspace, sharing is governed by roles plus per-dashboard grants — members see dashboards according to their role, and the Access tab can open a specific dashboard to specific members beyond that.

Ask-AI on a share

Both the Link and Embed tabs carry an Ask-AI for viewers toggle, off by default — turning it on is an explicit publisher choice, never a side effect of minting a link. Once enabled, viewers get a floating Ask AI button that opens a small chat panel over the shared view.

The agent is scoped strictly to that one share: it answers only from the cards on that dashboard or report, through token-scoped tools, with no visibility into anything else in the workspace. It’s rate-limited per share (a sensible default per hour, configurable) — a viewer who exhausts it sees “reached its Ask-AI limit for now” rather than a generic error, and if the server has no AI provider configured the panel says so plainly instead of hanging.

Embeds

The Embed tab produces a copyable snippet in two flavors:

• iframe — https://<your-host>/embed/<id>?token=<token> with sensible sandbox attributes.
• React — a <DataSquaresEmbed> component from @digisquares/datasquares-embed-react for React apps. See the React embed SDK guide.

Locking embeds down

Add allowed domains — the embed refuses to render anywhere else (“Domain not allowed”). Badges on the tab summarize the current config: toolbar visible/hidden, export allowed/disabled, domains.

How the check actually works: the content request that loads an embed’s data is issued by JavaScript running inside the iframe, so its Origin is always the DataSquares app itself — first-party, and useless for judging who framed it. The embed resolves its own framing page (via the browser’s ancestor-origin info, falling back to document.referrer) and declares it in a request header; the API checks that against your allowlist instead. A host that can’t be resolved — a hidden referrer, a sandboxed parent — is treated as an unidentified origin and fails closed under a restriction: hiding who you are is never a way through.

A rendering restriction, not an authorization boundary

The allowlist stops a share being displayed on a page you didn’t approve — which is what it’s sold as. It is not a credential check: Origin is a browser convention that any non-browser client can send whatever it likes for, so someone holding the token can still fetch the content directly with curl. The token remains the real secret — treat leaking it like leaking a password, allowlist or not. Separately, the platform’s own CSP intentionally leaves frame-ancestors open on /embed pages at the transport layer (an embed exists to be framed by someone), so this allowlist — not the browser’s framing headers — is the actual gate.

White-label branding

The Embed settings panel carries a logo and custom CSS applied inside every embed on that share, so an embedded dashboard can look like part of your product rather than like DataSquares.

Remote url() and @import are refused in custom CSS, naming the construct that was rejected. CSS can’t script, but a remote url() is a beacon: it would report the viewer’s IP to a third party once per matched selector. Reference data: URIs instead — those are accepted.

Usage

The same panel rolls up embed activity per share and per day — views, chart clicks, filter changes and page switches — so you can see which embeds are actually being used rather than merely deployed.

Customizing the embedded view

Query parameters control presentation: toolbar (show/hide), theme (dark), primaryColor, logoUrl (your logo instead of the default), and p_<id>=value to preset parameters. Embedded views keep the interactive toolkit — cross-filters, slicers, parameters — plus a fullscreen toggle, and prompt for the password when the share is protected.

Scheduled delivery

The Schedule tab emails the dashboard on a cadence — the server renders it (through the report export pipeline) and delivers the file, no browser involved.

• Frequency & time — daily, weekly (Monday), or monthly (the 1st), at the time you pick, in your timezone.
• Format — PDF, Excel, CSV, or PowerPoint.
• Recipients — any email addresses; add as many as you need.

Existing schedules are listed on the tab with a pause/resume switch and a delete button. Delivery history lives with the rest of the report schedules, which dashboards share under the hood.

Access (per-user grants)

The Access tab opens this dashboard to specific workspace members. Grants sit on top of roles: a member’s role is the floor, and a grant elevates their access to one dashboard only — it never takes anything away.

• Viewer — the member can open this dashboard even if their role can’t view dashboards at all. Their dashboard list shows the ones shared with them.
• Editor — the member can also edit this dashboard (layout, cards, settings) even if their role can’t edit dashboards.

Search members by email or name, pick the permission, and Grant. Granting someone who already has access updates their permission — that’s how you move a viewer to editor (or back). Revoke removes the grant; the member’s role-based access, if any, is untouched.

Managing access requires the same right as editing the dashboard: an editor role or an editor grant on it. Grants apply to workspace members only — for people outside the workspace, use a share link instead.

Related

• Exports — PDF/PPTX/PNG instead of a live link.
• Reports — paginated reports with scheduled delivery.
• Users & roles — role-based (workspace-wide) access.
• AI chat — the same governed agent, unscoped, for signed-in workspace members.