Embedded Analytics: Putting Dashboards Inside Your App

Embedded analytics means placing charts, dashboards and reports directly inside another application, such as a customer portal, a SaaS product or an internal tool, so people get insights without opening a separate BI tool. You can do it with a BI platform's embedding features (Power BI, Tableau, Looker, Metabase, Superset) or by building charts yourself, and the right choice depends on your users, your security needs and your budget.

What embedded analytics actually is

In a traditional BI setup, users log in to a reporting portal, find a dashboard and read it. With embedded analytics, the dashboard comes to the user. A logistics company might show each customer a delivery-performance dashboard inside its tracking portal. A sales app might display a rep's pipeline chart right next to the deal list. An HR system might include headcount trends on its home screen.

The key idea is context: the numbers appear where the decision happens. Users don't need a BI license of their own (in most "app owns the data" models), they don't need to learn a new tool, and they only see the data that belongs to them.

Two common scenarios

• Internal embedding: dashboards placed inside tools your own employees already use, such as an intranet, a CRM or Microsoft Teams. Users usually sign in with their company account.
• External (customer-facing) embedding: dashboards shown to customers, partners or suppliers inside your product. Your application handles the login and tells the BI platform which data each user may see.

Power BI uses exactly this split in its documentation: "embed for your organization" (the user owns the data) and "embed for your customers" (the app owns the data). Other platforms use different names, but the concept is the same.

Three ways to embed dashboards

Before comparing vendors, decide on the general approach. Each one trades effort against control.

For most small and mid-size teams, secure token-based embedding is the sweet spot: you reuse dashboards your analysts already built, and you keep control of who sees what.

Popular embedded analytics platforms

Power BI Embedded

Power BI offers a JavaScript client library and REST APIs to embed reports, dashboards and single visuals. For customer-facing scenarios, your backend authenticates with a service principal and generates embed tokens. Licensing depends on the scenario and on capacity (Power BI Embedded in Azure or Fabric capacity), and Microsoft changes these options over time, so check the official pricing page and our Power BI licensing guide before you commit.

Tableau, Looker and others

Tableau provides an Embedding API and connected-app authentication; Looker supports signed embedding where your server creates a signed URL for each user. Both are mature options for companies already using those tools. Commercial plans vary widely, so request a quote or read the vendor's pricing page.

Open-source options: Metabase and Superset

Metabase supports signed (static) embedding using a JSON Web Token, and its paid editions add more interactive embedding features. Apache Superset offers an embedded SDK with guest tokens. They are attractive for startups that want to self-host. Read our comparison of Metabase and Superset for the details.

How signed embedding works (with code)

Almost every secure approach follows the same pattern: the browser never receives your secret key. Your server signs a request that says "this user may see this dashboard with these filters, for the next few minutes," and the BI tool validates the signature.

Here is a minimal Python example for Metabase static embedding, using the PyJWT library:

import time
import jwt  # pip install PyJWT

METABASE_SITE_URL = "https://bi.example.com"
METABASE_SECRET_KEY = "load-this-from-an-environment-variable"

def dashboard_url(customer_id: int) -> str:
    payload = {
        "resource": {"dashboard": 12},
        "params": {"customer_id": customer_id},  # locked filter
        "exp": round(time.time()) + 60 * 10       # expires in 10 minutes
    }
    token = jwt.encode(payload, METABASE_SECRET_KEY, algorithm="HS256")
    return f"{METABASE_SITE_URL}/embed/dashboard/{token}#bordered=true&titled=true"

Your web page puts the returned URL inside an iframe. Because customer_id is part of the signed payload and the parameter is set as "locked" in Metabase, a user can't change it to see another customer's data. Power BI, Tableau and Looker follow the same logic with their own token formats.

Security and multi-tenancy checklist

Customer-facing analytics fail most often on security, not on chart design. Review these points before launch:

1. Filter by tenant at the data level. Use row-level security (RLS) or locked parameters so each customer only sees their rows. Our row-level security guide shows how RLS roles work in Power BI.
2. Test with two fake customers. Log in as customer A and customer B and confirm neither can see the other's data, including through exports and drill-throughs.
3. Disable features you don't need. Turn off "export underlying data," editing or sharing if customers shouldn't use them.
4. Protect the credentials. Store service-principal secrets and signing keys in a secret manager or environment variables.
5. Watch performance. An embedded report that takes 15 seconds to load feels broken inside an app. Pre-aggregate data and keep visuals per page to a reasonable number.
6. Log usage. Track which dashboards customers open so you know what to improve.

Build vs buy: how to decide

Ask three questions. First, how many different charts do users really need? If the answer is "three KPIs and a trend line," a chart library may be enough. Second, do analysts (not developers) need to update dashboards often? If yes, a BI platform saves a lot of engineering time. Third, what is your cost model? Some platforms charge per user, others per capacity or per session, and the difference matters a lot once you have hundreds of customers. Model your expected users and compare official pricing pages before deciding.

For a quick prototype, Python developers can also try Streamlit, which turns a script into a small web dashboard that can sit behind your own login.

Next steps

Start small: pick one dashboard that customers already ask for by email, decide whether the data is public or private, and build a proof of concept with token-based embedding in a test environment. Validate the security with two test accounts, measure load time, and only then roll it out. As your audience grows, revisit licensing and capacity so costs stay predictable.

Watch: video lessons

▶

Frequently asked questions