--- title: "Embedding introduction" description: "Different ways you can embed charts and dashboards, or all of Metabase, in your app." url: "https://www.metabase.com/docs/latest/embedding/introduction" version: "65" --- # Embedding introduction You can embed Metabase tables, charts, dashboards, AI chat---even Metabase's query builder---in your website or application. There are two ways to embed Metabase. - **[Modular embedding](#modular-embedding)**: embed individual Metabase components, like questions, dashboards, and AI chat, so they seamlessly integrate with your app. - **[Full app embedding](#full-app-embedding)**: embed the full Metabase app in an iframe, styled like your branding. Most people go with modular embedding, so you can integrate Metabase components into your app. Whichever way you embed, you'll also pick how Metabase authenticates the people viewing your embed. Authentication is a setting on what you embed, not a different kind of embedding. If you just want to share a chart or dashboard with anyone who has the link, and you don't need any authentication, take a look at [public links and embeds](#public-links-and-embeds). ## Embedding hub ![Embedding hub](https://www.metabase.com/docs/latest/embedding/images/embedding-hub-getting-started.png) Admins set up embedding in the Embedding hub. To get there, click the **grid** icon in the upper right and select **Embedding hub**. The hub opens to **Get started**, a checklist for your first embed. The sidebar has the rest of the embedding settings: - **Security**: turn on [modular embedding](https://www.metabase.com/docs/latest/embedding/modular-embedding.md#enable-modular-embedding), [guest embeds](https://www.metabase.com/docs/latest/embedding/guest-embedding.md#turning-on-guest-embedding-in-metabase), or [full app embedding](https://www.metabase.com/docs/latest/embedding/full-app-embedding.md#enabling-full-app-embedding-in-metabase), and set CORS and cookie settings. - **Authentication**: set up [JWT SSO](https://www.metabase.com/docs/latest/embedding/authentication.md). SAML settings stay in Admin. - **Permissions**: control what data people can see in your embeds. If you use tenants, see [data permissions for tenants](https://www.metabase.com/docs/latest/embedding/tenants.md#data-permissions-for-tenants). - **Tenancy**: [turn on multi-tenant strategy](https://www.metabase.com/docs/latest/embedding/tenants.md#enable-multi-tenant-strategy) and manage tenants, tenant groups, and tenant users. - **Appearance**: create and manage [embedding themes](https://www.metabase.com/docs/latest/embedding/appearance.md#embedding-themes). - **Localization**: [add a translation dictionary](https://www.metabase.com/docs/latest/embedding/translations.md#add-a-translation-dictionary). - **New embed**: open the [embed wizard](https://www.metabase.com/docs/latest/embedding/modular-embedding.md#create-a-new-embed). ## Modular embedding With [modular embedding](https://www.metabase.com/docs/latest/embedding/modular-embedding.md), you can embed individual Metabase [components](https://www.metabase.com/docs/latest/embedding/components.md) in your web app: dashboards, questions, the query builder, AI chat, and a collection browser. When you setting up an embed, you need to pick an authentication method: - **Metabase account (SSO)**, for [components with SSO authentication](#components-with-sso-authentication) - **Guest**, for [components with guest authentication](#components-with-guest-authentication) The authentication method you choose determines what people can do (see the comparison below). You can only use one authentication method per page of your app. A single page can't mix a question that uses SSO with a question that uses guest authentication. ## Comparison between SSO and guest authentication All SSO options require a Pro or Enterprise plan. | Feature | SSO | Guest | | ----------------------------------------------------------------------------------------- | --- | ----- | | Charts | ✅ | ✅ | | Dashboards | ✅ | ✅ | | [Filter widgets](https://www.metabase.com/glossary/filter-widget) | ✅ | ✅ | | Export results\* | ✅ | ✅ | | [Light and dark themes](https://www.metabase.com/docs/latest/embedding/appearance.md#dark-mode-and-light-mode) | ✅ | ✅ | | Row-level data segregation | ✅ | ✅ | | [Drill-through menus](https://www.metabase.com/docs/latest/questions/visualizations/drill-through.md) | ✅ | ❌ | | [Query builder](https://www.metabase.com/docs/latest/questions/query-builder/editor.md) | ✅ | ❌ | | [SQL editor](https://www.metabase.com/docs/latest/questions/native-editor/writing-sql.md) | ✅ | ❌ | | [AI chat](https://www.metabase.com/docs/latest/embedding/ai-chat.md) | ✅ | ❌ | | [Collection browser](https://www.metabase.com/docs/latest/embedding/browser.md) | ✅ | ❌ | | Advanced [Tenant](https://www.metabase.com/docs/latest/embedding/tenants.md) and [permissions](https://www.metabase.com/docs/latest/permissions/embedding.md) management | ✅ | ❌ | | [Advanced theming](https://www.metabase.com/docs/latest/embedding/appearance.md) | ✅ | ❌ | | [Custom visualizations](https://www.metabase.com/docs/latest/embedding/custom-visualizations.md) | ✅ | ❌ | | [Usage analytics](https://www.metabase.com/docs/latest/usage-and-performance-tools/usage-analytics.md) | ✅ | ❌ | | Customize layouts and behavior with [plugins](https://www.metabase.com/docs/latest/embedding/sdk/plugins.md) | ✅ | ❌ | | [Locked filters](https://www.metabase.com/docs/latest/embedding/parameters.md#restrict-data-on-guest-embeds)\*\* | ❌ | ✅ | \* Each authentication method allows data downloads by default, but only [Pro and Enterprise](https://www.metabase.com/pricing) plans can disable data downloads. \*\* Components that use SSO don't need locked filters. Since Metabase knows who's viewing, you can segregate data with [permissions](https://www.metabase.com/docs/latest/permissions/embedding.md) instead. There's a little more set up, but much less long-term overhead. ### Components with SSO authentication With SSO, Metabase can know who's viewing what, which unlocks a lot of stuff. You can automatically apply [data permissions](https://www.metabase.com/docs/latest/permissions/embedding.md), which means you can give people access to all the cool tools Metabase provides, and everyone will only ever see the data they're allowed to. **When to use SSO**: You want to offer multi-tenant, self-service analytics, or you want to include the query builder, AI chat, drill-through, or a collection browser. SSO requires a Pro or Enterprise plan, and everyone viewing the embedded component needs their own Metabase account. To set up JWT or SAML, check out [modular embedding authentication](https://www.metabase.com/docs/latest/embedding/authentication.md). If you're building a SaaS product with embedded analytics for multiple customers, you can keep customer data isolated with [Tenants](https://www.metabase.com/docs/latest/embedding/tenants.md). Accounts for these embedded people in your Metabase count toward the [accounts billed in your Metabase plan](https://www.metabase.com/how-billing-works). But by letting your customers self-serve their data, you save time on developing bespoke charts. And you can charge _more_ for a premium analytics experience. If you plan on giving a lot of your customers self-service access to their data, you should consider an enterprise plan, with custom pricing that scales with your business. ### Components with guest authentication With [guest authentication](https://www.metabase.com/docs/latest/embedding/guest-embedding.md), Metabase doesn't create a session for the person viewing the component, so you don't have to create a Metabase account for everyone who sees your charts and dashboards. Guest authentication works on all Metabase plans, including OSS and Starter. Guest doesn't mean unsecured. Metabase only loads the component if the request carries a JWT signed with a secret shared between your app and your Metabase. What Metabase doesn't have is an identity: with no account to check permissions against, Metabase can't tell whether a new query is one that person should be allowed to run. That's why components with guest authentication are view-only. **When to use guest**: embedding charts and dashboards where you don't want to offer ad-hoc querying or chart drill-through. To filter data down to what's relevant to the person viewing, use [locked parameters](https://www.metabase.com/docs/latest/embedding/parameters.md#restrict-data-on-guest-embeds), where your app sets the filter value in the signed token. ## Set up modular embeds with web components or React Whichever way you authenticate, you can set up modular embeds two ways. - **Web components**: a script tag plus HTML elements like ``. Web components have no build step and no framework requirement, so they work in plain HTML, Vue, Svelte, Rails, React, or any framework you like. Metabase's [in-app wizard](https://www.metabase.com/docs/latest/embedding/modular-embedding.md) writes the code for you. - **React SDK**: React components that you import and compose yourself. The [SDK](https://www.metabase.com/docs/latest/embedding/sdk/introduction.md) gives you more control: you can build custom layouts and [customize behavior with plugins](https://www.metabase.com/docs/latest/embedding/sdk/plugins.md). If your app runs on React and you want that extra control, go with the SDK. Otherwise start with web components. You can always move to the SDK later. ## Full app embedding [Full app embedding](https://www.metabase.com/docs/latest/embedding/full-app-embedding.md) allows you to embed the entire Metabase app in an iframe, and integrate Metabase SSO with your app's authentication. ## Public links and embeds If you'd like to share your data with the good people of the internet, admins can create a [public link](https://www.metabase.com/docs/latest/embedding/public-links.md) or embed a question or dashboard directly in your website. A public link is a URL you can hand to anyone. A public embed is an iframe snippet you drop into one of your pages. Neither one is really an embedding setup — there's no authentication, and anyone with the link can see the data. **When to use public links and embeds**: one-off charts and dashboards. Admins can use public links when you just need to show someone a chart or dashboard without giving people access to your Metabase. And you don't care who sees the data; you want to make the item available to everyone. ## Static embedding is deprecated Static embeds (also called signed embeds) put a signed JWT in an iframe URL, like `/embed/dashboard/YOUR_JWT_TOKEN`. Static embedding is deprecated in favor of [guest embeds](https://www.metabase.com/docs/latest/embedding/guest-embedding.md), which use the same secret key and the same signed token, but render a web component instead of an iframe. Existing static embeds keep working. For items published with static embedding, the embed modal still offers **Use static embedding instead**. Their hash parameters are the same as the ones for public embeds, which are listed in [Appearance parameters](https://www.metabase.com/docs/latest/embedding/public-links.md#appearance-parameters). To put filter values in the URL, see [Parameters in iframe embeds](https://www.metabase.com/docs/latest/embedding/parameters.md#parameters-in-iframe-embeds). To migrate a static embed to a guest embed: - Keep your server-side signing code. The token payload (`resource`, `params`, and `exp`) is the same. - Replace the iframe with a `` or `` element, and pass the token in its `token` attribute, as shown in [Creating a guest embed](https://www.metabase.com/docs/latest/embedding/guest-embedding.md#creating-a-guest-embed). - If you use an AI coding agent, give it the [Static → guest embeds skill](https://skillsmp.com/creators/metabase/agent-skills/skills-metabase-static-embedding-to-guest-embedding-upgrade), which walks through the migration. See also [AI agent resources](https://www.metabase.com/docs/latest/embedding/ai-agent-resources.md). ## Resources for AI agents If you're using an AI agent to help you embed Metabase in your app, check out [AI agent resources](https://www.metabase.com/docs/latest/embedding/ai-agent-resources.md). ## Tracking embed usage > Tracking embed usage is only available on [Pro](https://www.metabase.com/product/pro) and [Enterprise](https://www.metabase.com/product/enterprise) plans (both self-hosted and on Metabase Cloud). [Usage Analytics](https://www.metabase.com/docs/latest/usage-and-performance-tools/usage-analytics.md) tracks embed usage, including embedding context, authentication methods, hostname, and other metadata. Check out the [Embedding usage dashboard](https://www.metabase.com/docs/latest/usage-and-performance-tools/usage-analytics-reference.md#embedding-usage). For information about the anonymous usage data Metabase collects from embedded components, see [Embedding telemetry](https://www.metabase.com/docs/latest/installation-and-operation/information-collection.md#embedding-telemetry). ## Embedding limitations - Currently, you can't embed [documents](https://www.metabase.com/docs/latest/documents/introduction.md) (though you can create [public documents](https://www.metabase.com/docs/latest/embedding/public-links.md)). - [Modular embeds](https://www.metabase.com/docs/latest/embedding/modular-embedding.md) that use SSO can render [custom visualizations](https://www.metabase.com/docs/latest/questions/visualizations/custom.md), but only the custom visualizations you add to your [allowlist](https://www.metabase.com/docs/latest/embedding/custom-visualizations.md). Components that use guest authentication fall back to the default visualization. ## Further reading - [Tenants](https://www.metabase.com/docs/latest/embedding/tenants.md). - [Customizing Metabase's appearance](https://www.metabase.com/docs/latest/configuring-metabase/appearance.md). - [Securing embedded Metabase](https://www.metabase.com/docs/latest/embedding/securing-embeds.md).