Signed embeds
Per-viewer row filtering inside an iframe on your own site.
An ordinary embed token is one string that shows everyone the same thing. A signed embed carries a verified claim about who is looking, which is the only way per-viewer row filtering can work inside somebody else's page.
The shape of it
- Create a signing key for the dashboard. The secret is shown once and never stored in readable form — a database read cannot mint tokens.
- Your backend signs a short-lived token naming the row-security group(s) the current viewer belongs to.
- Your page embeds the dashboard using that token.
Because your backend decides which group to name, and it already knows who is signed in, each customer sees only their own rows.
Why your backend must sign it
The claim is only as trustworthy as the thing making it. A token minted in the browser could be edited by the person holding it; one minted by your server and signed with your key cannot.
Practical notes
- Keep expiry short. Minutes, not days. Tokens are cheap to mint.
- Rotate keys without downtime — several keys can be live at once, so you can issue new tokens before revoking old ones.
- A token naming an unknown group is refused, rather than falling back to showing everything.