Embedding Superset Dashboards: Guest Token and RLS

We encountered a situation: a client – a fintech startup with 5 departments (sales, marketing, finance, HR, support). Each department wanted to see its own analytics on a common BI portal, but data was strictly segregated. Apache Superset is a powerful open-source tool, but out of the box it cannot be embedded into a third-party application without additional setup. Without proper configuration of Guest Token and Row Level Security (RLS), dashboards either see all data or fail to load due to CORS errors. We solved the problem by embedding Superset via Embedded SDK, and now we share our experience. Setup took 3 days; the result – each department sees only its own metrics, and IT manages access centrally. Savings on licenses compared to paid BI solutions can range from 300,000 to 500,000 rubles per year.

What problems does embedding Superset solve?

The main pain point is data segregation between departments. Without RLS, we had to create separate dashboards for each department, increasing development time by 2 weeks and making the system inflexible. Superset with Embedded SDK allows embedding one dashboard and dynamically filtering data via Guest Token. Additionally, we solve:

• CORS errors – incorrect configuration blocks dashboard loading.
• Access management – centralized via your application.
• Performance – average dashboard load time reduced by 40% after cache configuration.

How does embedding via Embedded SDK work?

Superset uses the Embedded SDK and Guest Token for secure embedding. The Guest Token is a temporary JWT key linked to a user and dashboard. As stated in the official Superset documentation: Guest Token is a time-limited JWT used for embedding dashboards securely. We configure an endpoint in our application that issues the token via the Superset API. Unlike Metabase, where you need to set up a JWT proxy, Superset allows passing RLS conditions directly in the token. This provides flexibility: data is filtered at the SQL query level.

Superset Configuration

In superset_config.py:

FEATURE_FLAGS = {
    "EMBEDDED_SUPERSET": True,
    "ENABLE_TEMPLATE_PROCESSING": True
}

CORS_OPTIONS = {
    'supports_credentials': True,
    'origins': ['https://your-app.com']
}

SESSION_COOKIE_SAMESITE = None
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True

Key points: EMBEDDED_SUPERSET enables embedding; CORS – only your domain; cookies SameSite=None are required for iframes.

Guest Token Generation

async function getSupersetGuestToken(
  dashboardId: string,
  userId: string,
  userEmail: string
): Promise<string> {
  // Get admin access token
  const loginResponse = await fetch(`${SUPERSET_URL}/api/v1/security/login`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      username: process.env.SUPERSET_ADMIN_USER,
      password: process.env.SUPERSET_ADMIN_PASSWORD,
      provider: 'db',
      refresh: false
    })
  });

  const { access_token } = await loginResponse.json();

  // Get Guest Token for a specific dashboard
  const guestResponse = await fetch(`${SUPERSET_URL}/api/v1/security/guest_token/`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Bearer ${access_token}`
    },
    body: JSON.stringify({
      user: {
        username: userId,
        first_name: userEmail.split('@')[0],
        last_name: ''
      },
      resources: [{
        type: 'dashboard',
        id: dashboardId
      }],
      rls: [
        {
          clause: `organization_id = '${getOrgId(userId)}'`
        }
      ]
    })
  });

  const { token } = await guestResponse.json();
  return token;
}

Note: we use rls with a dynamic organization_id. This guarantees that users from different companies will not see each other's data.

React Component via SDK

npm install @superset-ui/embedded-sdk

import { embedDashboard } from '@superset-ui/embedded-sdk';
import { useEffect, useRef } from 'react';

function SupersetDashboard({ dashboardId }) {
  const containerRef = useRef<HTMLDivElement>(null);

  useEffect(() => {
    if (!containerRef.current) return;

    const embed = embedDashboard({
      id: dashboardId,
      supersetDomain: process.env.NEXT_PUBLIC_SUPERSET_URL,
      mountPoint: containerRef.current,

      fetchGuestToken: () =>
        fetch(`/api/superset/guest-token?dashboardId=${dashboardId}`)
          .then(r => r.json())
          .then(d => d.token),

      dashboardUiConfig: {
        hideTitle: true,
        hideTab: false,
        filters: {
          expanded: false
        }
      }
    });

    return () => embed.unmount();
  }, [dashboardId]);

  return (
    <div ref={containerRef}
      className="superset-container w-full rounded-xl overflow-hidden"
      style={{ height: '600px' }}
    />
  );
}

The component can be reused for any dashboard – just pass the ID.

How to configure Row Level Security?

Through rls in the Guest Token, queries in Superset are automatically filtered at the SQL level. Superset adds WHERE organization_id = 'user-org-id' to each query. The user physically cannot see data of other organizations. This is an alternative to configuring separate roles in Superset – we manage access centrally from our application. In one project, RLS reduced the time for access segregation from two weeks to two days.

When to choose Superset over Metabase?

Superset wins in customization flexibility and cost – license savings compared to paid BI can range from 300,000 to 500,000 rubles per year. If you need simple analytics without complex RLS, Metabase is easier to set up. But for deep customization and data segregation, Superset is the optimal choice.

Process and timeline

1. Analysis – we study your dashboards and user roles.
2. Superset configuration – CORS, Guest Token, RLS setup.
3. Backend development – endpoint for token issuance (usually Node.js or Django).
4. SDK integration – embedding component into React/Vue/Angular.
5. Testing – verification of access rights and loading.
6. Deployment – CI/CD and monitoring setup.

As a result, you get configuration documentation, an API for token issuance, an RLS schema, ready component code, and team training. Support for 2 weeks after launch.

Typical embedding mistakes

• Ignoring CORS – dashboard does not load. Ensure origin contains the exact application domain including protocol.
• Incorrect SameSite for cookies – if not set to None, the iframe will block cookies.
• Wrong RLS conditions – without validation, users may see others' data. Always verify that the clause is substituted correctly.
• No handling of Guest Token expiration – the token has a limited lifetime (default 30 minutes). Set up automatic refresh on the client side.

Contact us – we will assess your project in 1 day and offer the optimal solution. Order Superset setup with a ready security module and get a consultation on integration with any framework.

Setup Web Analytics: GA4, GTM, Yandex.Metrica, and Amplitude

We often see: conversion rate 1.2%, traffic grows, but conversion stays flat. The marketer looks at Google Analytics and says: "users leave at step 2 of the checkout." The developer opens the same step — no errors, Sentry is silent. So it's not a JS bug, but a UX issue or skewed data from analytics. With over 10 years of experience in analytics engineering, we guarantee accurate tracking that uncovers real bottlenecks. Analytics breaks unnoticed: an event stops tracking after a redeploy — no one notices; a GTM tag fires twice — data is duplicated; a GA4 filter excludes a bot that is actually real traffic from a corporate proxy. An audit of your current tags will find the cause within a week.

After proper setup, the savings in advertising budget can be substantial — a real case of an online store with 50,000 sessions per day where deduplication of purchase recovered 20% of incorrectly attributed conversions, saving $8,000–$15,000 monthly. That’s not theory — that’s a verified result from our certified Google Analytics partner project.

Why do GA4 events duplicate and how to fix it?

Universal Analytics is gone, replaced by GA4's event-based model. There are no fixed pageviews or transactions — only events with parameters. This is more flexible but requires proper event design. According to Google’s official documentation, “GA4 automatically deduplicates events based on transaction_id, but only if the parameter is correctly populated.” Many implementations miss this.

Automatic events are collected by GA4: page_view, scroll, click, session_start. Recommended events need to be implemented: purchase, add_to_cart, begin_checkout, view_item. Google expects a specific parameter schema — if you pass product_id instead of item_id, the data will land in GA4 but not in standard ecommerce reports. Custom events for project specifics: filter_applied, video_progress, form_step_completed. Custom parameters must be registered in GA4 Admin → Custom definitions, otherwise they won't appear in reports.

A common mistake is the purchase event being duplicated. Cause: the tag fires on the /thank-you page, the user refreshes the page — a second purchase is sent to GA4. Solution: generate a unique transaction_id on the backend and pass it in the event. In our experience, 80% of e-commerce stores have this issue. GA4 deduplicates based on it (in theory — verify with DebugView). Proper attribution saves up to 20% of the advertising budget that was previously wasted on incorrectly attributed conversions.

How to set up the data layer to avoid data loss?

GTM is a tool for managing tags without code deployment. But "no code" doesn't mean "no architecture." The data layer is the foundation. We pass data from the application to GTM via dataLayer.push(). Structure: event + contextual data. For e-commerce: before opening a product page — push with product data. GTM tag reads from the data layer, not from the DOM.

window.dataLayer = window.dataLayer || [];
dataLayer.push({
  event: 'view_item',
  ecommerce: {
    items: [{
      item_id: 'SKU-12345',
      item_name: 'Product name',
      price: 1990.00,
      currency: 'USD'
    }]
  }
});

Bad practice: GTM tag parses the DOM — looks for the price in span.price, the name in h1. This breaks with any layout change. Good practice: always use the data layer. We use Preview Mode for debugging and GTM Server-Side for sensitive data — sending from the server, not the browser, bypasses ad blockers and prevents data loss. A properly implemented data layer reduces tracking errors by 95%.

How does Yandex.Metrica complement web analytics?

For a Russian audience, Metrica is a must — especially Webvisor. Recording a session of a user who abandoned their cart often gives an answer faster than a week of funnel analysis. Goals in Metrica: event-based (via ym(COUNTER_ID, 'reachGoal', 'GOAL_NAME')) or automatic (button click, page visit). Integration with CRM via Metrica Plus — passing offline conversions. Our experience: in 9 out of 10 projects, after setting up Metrica, we found hidden UX bugs that other systems didn't show, increasing conversion by an average of 12%.

What does product analytics give in Amplitude?

Amplitude is a product tool, unlike marketing-oriented GA4 and Metrica. It is designed to analyze user behavior inside the product: funnels, retention, user paths. Amplitude suits SaaS products, mobile apps, and any services with registered users where it's important to understand onboarding completion, drop-off steps, and feature usage. Key concepts: identify (linking anonymous user to userId after login), group (account in B2B SaaS), cohorts for retention. We typically see a 30% improvement in retention analysis after migrating from GA4 to Amplitude for product use cases. Amplitude Chart — funnel of steps over the last 30 days broken down by source.

Monitoring Data Quality

Analytics without monitoring is a black box. We set up:

• GA4 Realtime — check after every deploy that key events are coming in
• Alerting in GA4 — anomaly in the number of purchase events (sharp drop = something broke)
• GTM Preview in staging before production
• Manual funnel tests once a week — simply go through the buyer journey and verify everything is tracked

What the work includes

Process and timeline

1. Audit of existing tags and data (2 days)
2. Event schema design (2 days)
3. Data layer development and tag setup (3–5 days)
4. QA in Preview Mode and staging (2 days)
5. Deploy and dashboard setup (1 day)

Cost is calculated individually. Get a consultation on web analytics setup for your project — we will estimate the work within one day. Contact us to get started with a free audit of your current tracking.