Forum Discussion

jubinsoni's avatar
jubinsoni
Icon for Memorable Member rankMemorable Member
20 hours ago

Embed token refresh for long-lived sessions: how do you do it in a SPA?

Hi all,

We embed Power BI reports in a single-page app for external customers (app owns data), and people tend to leave the page open for hours. I know embed tokens expire, so I want to refresh them before that happens without the user noticing.

The plan is to schedule a refresh a few minutes before expiry and push the new token into the embedded report:

const refreshAt = Date.parse(token.expiration) - 5 * 60 * 1000;
setTimeout(async () => {
  const fresh = await getNewEmbedToken();   // our backend
  await report.setAccessToken(fresh.token);
}, Math.max(0, refreshAt - Date.now()));

Is that how you do it? How early do you refresh, and what do you do when the refresh call fails (retry, or just reload the visual)? Also, if there are several reports on one page, do you update each one separately?

Thanks!

Need Help

1 Reply

  • v-csrikanth's avatar
    v-csrikanth
    Icon for Community Support rankCommunity Support
    5 hours ago

    Hi jubinsoni​

    Yes, you are on the right track. For app-owns-data, getting a new embed token from your backend and calling report.setAccessToken() lets you renew it without reloading the report.

    Five minutes before expiry is a reasonable starting point. The main change is to schedule the next refresh after each successful renewal, using the new token’s expiration your current timer runs only once.

    A few things to watch:

    • Recheck expiry when the tab becomes visible or connectivity returns, since background timers can be delayed. Avoid overlapping refresh requests.
    • Retry temporary failures with limited, increasing delays rather than immediately reloading. If the user’s application session has expired, prompt them to sign in again.
    • If the token expires while offline, obtain a valid token once connectivity returns and try setAccessToken() before considering re-embedding.

    For multiple reports, call setAccessToken() on each report instance. You can renew once and reuse that token only if it covers all those reports and the appropriate customer/RLS identity; otherwise, renew their tokens separately.

    One important distinction: the SDK’s accessTokenProvider automatic-refresh hook is for user-owns-data, not app-owns-data.

    References: Token refresh guidance · Multi-resource embed tokens

    Regards,
    Microsoft Fabric Community Support