metabase / metabase/metabase

Support SDK guest embeds without an initial JWT

Open
#80,188 0 comments 0 reactions 0 assignees View on GitHub
.Needs Triage .Team/Embedding Priority:P2 Type:New Feature
Dominant language
Clojure
Stars
49.3k
Forks
6.8k
Avg merge
1d 13h
Merged PRs (30d)
653

Description

**What problem will this feature request solve?**

When using guest embeds with JS components, the sample generated code suggests to manually fetch the initial JWT from the IdP and add it to the HTML:

```html

function defineMetabaseConfig(config) {
window.metabaseConfig = config;
}

defineMetabaseConfig({
"isGuest": true,
"instanceUrl": "https://metabase-63.metabase-compose.orb.local"
});

```

How to exactly fetch and inject the initial token is left as an exercise for the reader. This can be done with a server-rendered template, or by making a client-side call to the IdP and dynamically creating the `metabase-dashboard` or desired component.

One way to make this easier is to pass a `guestEmbedProviderUri` and a resource ID, and omit the initial `token`, so that the JS library automatically fetches it:

```html

function defineMetabaseConfig(config) {
window.metabaseConfig = config;
}

defineMetabaseConfig({
"isGuest": true,
"instanceUrl": "https://metabase-63.metabase-compose.orb.local",
"guestEmbedProviderUri": "https://jwt-idp.example.com",
});

```

This is a convenient feature which makes implementation easier, and also supports JWT refreshing without any extra work. However, if you try the equivalent approach with the React SDK, this does not work:

```tsx
import {
MetabaseProvider,
defineMetabaseAuthConfig,
StaticDashboard,
} from "@metabase/embedding-sdk-react";

const instanceUrl = import.meta.env.VITE_METABASE_INSTANCE_URL;

const guestAuthConfig = defineMetabaseAuthConfig({
metabaseInstanceUrl: instanceUrl,
isGuest: true,
guestEmbedProviderUri: "https://jwt.metabase-compose.orb.local/metabase_guest_token",
})

function App() {
return (



);
}

export default App;
```

Image

**Describe the solution you'd like.**

Support automatically fetching the initial JWT in the SDK the same way it is currently supported for JS guest embeds

**How does this feature request impact you?**

Inconvenient for users migrating from JS guest embeds to SDK, or existing SDK users wanting to also use guest embeds

It's an annoying difference between JS and SDK implelmentations that users have to keep in mind when choosing one option over another

**Additional information**

N/A

Contributor guide

Open the contributing guide

Research direction

Start with the React SDK entry points shown in the issue: MetabaseProvider, defineMetabaseAuthConfig, and StaticDashboard. Compare their guestEmbedProviderUri handling with the existing JS guest embed behavior, focusing on how the initial JWT is obtained and refreshed. Done means the React example works without an initial token and supports the same automatic guest-token behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript
Domain
authentication, frontend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.