Mint embed sessions

Every end-user dashboard view starts with a server-side session mint — your backend calls Embedded Canvas; the browser never holds long-lived secrets.

Recommended pattern (BFF)

POST /your-api/embed/session
Authorization: Bearer <your-user-session>

Your BFF:

Resolves the authenticated end user → customer_id (tenant key)
Calls Embedded Canvas with your embed API key (server only)
Returns guestToken + runtime URL to the browser

Public session API

GET /embed/superset/{embedToken}/session?customer_id={tenant}
Authorization: Bearer {EMBED_API_KEY}

200 → billable embed view recorded (see signed-in Usage for caps) 429 embed_view_limit → monthly cap reached — contact us or wait for UTC month reset

JWT path (optional)

Workspaces with signing keys can mint JWTs instead of API-key session fetch — see JWT signing key path.

Error handling

Session responses include stable code values (for example embed_view_limit, tenant_mismatch, jwt_required). Handle HTTP status + code in your BFF; surface a clear message to the host UI via the SDK onError / onViewLimit callbacks.

Security

Never expose embed API keys or signing keys to the browser
Do not log full guest tokens in production
Map your user id → customer_id consistently for RLS