How to embed Tableau
into Embedportal.

Why this is needed

To embed Tableau views securely, you need to set up a Connected App in Tableau Cloud or Tableau Server. This enables JWT-based authentication, allowing Embedportal to generate trusted embed URLs for your Tableau content while Tableau continues to enforce your access controls and row-level security.

works with — Tableau Cloud, and Tableau Server 2021.1 or newer.

Prerequisites

• A Tableau Cloud site or Tableau Server 2021.1+ that you administer.
• A Tableau Site Admin account (Server Admin on Tableau Server). Connected Apps can only be created with admin permissions.
• An Embedportal workspace. Starter includes one BI integration; Professional and Enterprise include unlimited.
• About 30 minutes end-to-end.

Access Connected Apps Settings

Tableau Cloud — Sign in as a Site Administrator. Go to Settings → Connected Apps.

Tableau Server — Sign in as a Server or Site Administrator. Go to Settings → Connected Apps.

Create a New Connected App

1. Click New Connected App.
2. Name the Connected App atSpark Integration. This is the name Embedportal expects.
3. Select Direct Trust (JWT-based authentication). Embedportal signs short-lived tokens that Tableau trusts directly.
4. Enable Allow access to REST API. Embedportal uses the REST API to fetch the list of views and workbooks you can embed.

Configure Domain Allowlist

Add your application domain to the Connected App’s allowlist. For example:

dev.atspark.com

This ensures Tableau content can only be embedded on your domain — not on someone else’s copy-paste of the snippet.

• Add the exact hostname you’ll embed from (no protocol, no path).
• If you’ve set a custom domain on a Professional or Enterprise plan, add that instead.
• Do not add wildcard domains or third-party URLs.

security — the allowlist is your line of defence against embed-jacking. Keep it strict.

Copy Connected App Credentials

After creating the Connected App, Tableau displays three values. Copy each into the matching field in Embedportal:

important — the Secret Value cannot be retrieved after the first reveal. If you close the dialog without saving, generate a new secret.

Enter Server Details

Paste your Tableau instance URLs into Embedportal. The form has two fields: Slug URL (the full Tableau server URL) and Content URL (your site slug).

Tableau Cloud

• Slug URL: https://yoursite.online.tableau.com — or your regional URL e.g. https://prod-apnortheast-a.online.tableau.com
• Content URL: yoursite — the slug in your Tableau Cloud URL after /site/.

Tableau Server

• Slug URL: https://tableau.yourcompany.com
• Content URL: yoursite — or leave blank for the default site.

Set Tableau Username

Enter the Tableau username (email address) that will be used for JWT authentication. In Embedportal this field is labeled Cloud User (Email Address). The user must have appropriate permissions to view the content you want to embed.

user@example.com

tip — use a service account username, not a personal account.

• Service accounts keep embeds working when employees leave or change roles.
• Audit logs stay clear — every embed session is attributed to one identifiable actor.
• Rotating a service-account password doesn’t break the embed; rotating the Connected App Secret Value does.

Security best practices

• Use a dedicated service account with the minimum permissions required to view embedded content.
• Rotate Connected App secrets on a schedule — every 12 months is a reasonable default.
• Keep the domain allowlist strict. Only add domains you control.
• Monitor Connected App usage in Tableau’s admin views for unexpected traffic patterns.
• If a secret leaks, delete the Connected App in Tableau immediately and create a fresh one.
• For per-viewer data isolation, follow the row-level security guide — Tableau’s USERATTRIBUTE() function plus Embedportal’s session-level rule forwarding.
• Weighing Tableau against other embed options? See the Tableau Embedded vs Embedportal comparison or the 2026 embedded-analytics pricing breakdown for the full economics.

Troubleshooting

• Connection test fails with 401 — the Secret Value doesn’t match. Regenerate the secret in Tableau and paste the fresh values.
• Connection test fails with 403 — the Connected App is disabled, or the Tableau username doesn’t have permission to access the REST API.
• Dashboard loads blank inside the portal — the View URL slug is case-sensitive. Copy it exactly from Tableau.
• Dashboard shows all rows even though RLS is on — in Tableau, the RLS calculated field must be applied as a data source filter, not a view or dashboard filter.
• Users see “not authorised” — the service-account username in Embedportal doesn’t have access to the view. Grant the account project-level view permission.
• Embed works internally but not from a different domain — the domain isn’t on the Connected App’s allowlist. Add it.