Operator console

Audience: Your platform / ops team (Platform tier) — provision embed infrastructure before engineering mounts the SDK.

Sign in at embeddedcanvas.com. Admins land in the Portal (/portal) and open Operator console from Portal → Build (it opens in a new tab at /analytics); in Embed only workspaces Admins land in the console directly. Only Admins have the Operator console. The landing is a KPI overview. Open hubs from the sidebar. The analytics runtime starts automatically after signup — there is no Setup wizard.

What you do here

Connect your warehouse, register dashboards for embed, issue credentials to engineering, and verify tenant isolation before customers see charts in your product.

You do not need to write application code — hand embed tokens and API keys to your integrator team securely.

Engineering walkthrough: Quickstart · Customer integrator guide.

Sidebar map

Dashboard builder, Business Model and Query Builder open from the Portal (Build section), each in a new tab. In Embed only workspaces (no Portal) they stay in the console sidebar.

Before you start

1. Complete Organization invites — every operator must be in the correct Clerk org.
2. Sign in and open Operator console. Wait until the preparing overlay clears.

Runtime

The control plane starts your analytics runtime after signup. Confirm Runtime healthy on the Operator console landing. Open Dashboard builder from Portal → Build (or the console sidebar in Embed only workspaces) — Apache Superset opens with control-plane SSO.

Builder access (recovery) — manual username/password with Show password once is break-glass only if launch fails. Store credentials in your team password manager.

End customers never use the builder — only your analytics team authors dashboards there.

Connections — warehouse and tenant column

Open Connections (page title Connect customer database).

Invite operators

Team & access (Operator console → Settings) → invite by email. See Organization invites.

Connect your warehouse

1. Allowlist egress IPs shown in the connect form (control plane + analytics runtime).
2. Enter connection details → Test & connect to runtime, then sync.
3. On success, the runtime can query your mart.

Guide: Connect warehouse.

Tenant column

Set the column used for row-level isolation on each connection (default customer_id). Save after changes — it must match that warehouse’s datasets. Other connections can use a different name.

Dashboards — register for embed

In the builder:

1. Create datasets (expose the tenant column — do not hard-code one tenant in SQL).
2. Build and publish a dashboard.
3. Embed dashboard → enable → copy embed UUID.
4. Set Allowed domains for every parent origin that will host the embed.

In Operator console → Dashboards (Register dashboards):

1. Register dashboard with embed UUID and display name.
2. Set Iframe parent origins to the same list as Allowed domains (dual allowlist).

Missing either list causes blank embeds or CSP errors.

Guide: Dashboards & allowlists.

Embed — Connect your application

1. Open Embed in the sidebar. Create an embed API key (ec_live_…) — recommended for session-route BFF integration. Copy the secret once; it cannot be shown again.
2. Optional: create a workspace signing key for the JWT path instead of (or in addition to) an embed API key.
3. Hand deliverables to engineering. Framework snippets and CSP packs are on this page (stack picker).

Engineering: Quickstart · Intro tutorials in the developer docs sidebar.

Test Embed and Test & monitor

1. Test Embed (/analytics/test-embed) — two different customer ids must show different numbers.
2. Test & monitor (/analytics/test) — warehouse health, session mint, and RLS checks.
3. After traffic starts, use Usage and Health & monitoring under Insights, and Audit & governance under Settings.

Open Usage to confirm session mints increment during QA.

Share dashboards

Share dashboards grants Viewer access (open in Apache Superset) or build access (co-edit) to teammates from Team. This is not Tenant catalog (which dashboards a customer can open in your product) and not Apache Superset’s permalink Share menu.

For day-to-day staff access, use the Portal (/portal): put dashboards and saved queries in Team content folders and set Manage access on the folder. See the Portal guide.

Guide: Share dashboards.

Builder vs embed vs Share

Related

• Quickstart
• Mint embed sessions
• Security & compliance
• Platform operator guide (Help)