Forum Discussion
Helper IEmbed PowerBI in Customer's Hosted Browser and Web Application
Hi PowerBI Community,
My customers would like to embed my PowerBI reports in their browsers and web applications. Using service principal (as per this documentation), so far my understanding is that I need to share these five parameters with them so that they will get both [embed_url] and [embed_access_token] (which only valids for an hour, thus it needs to be refreshed every hour):
- client_id
- client_secret
- tenant_id
- workspace_id
- report_id
Sharing the first three parameters sounds risky as they might be able to access and control assets outside the intended scope. Are there any alternative ways for me to safely provide them [embed_url] and [embed_access_token]?
Thank you in advance.
2 Replies
Hi fxs7576_02 ,
For your needs: Is there another way to securely provide [embed_url] and [embed_access_token]? If you are not comfortable directly providing the client_secret to the customer, you can use the suggested methods in the documentation to dynamically generate the embed_access_token using Postman or Power Automate’s HTTP action. By using the dynamically generated embed_access_token for embedding your reports, you can ensure a higher level of security.
Postman documentation overview | Postman Learning Center
Using the HTTP action to make requests with Microsoft Flow - Microsoft Power Platform Blog
Best Regards,
Liu Yang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
fxs7576_02Thanks Anonymous . Indeed that I'm not comfortable sharing the client_secret_key.
the suggested methods in the documentation to dynamically generate the embed_access_token using Postman or Power Automate’s HTTP actionIf I use Postman with service principal method to generate embed_access_token, which key-value pairs are required? And will the generated embed access token have an expiration of an hour, after which I need to keep providing them a new one every hour?
So far the only step-by-step documentation for Postman I've found (here) requires a username and password, the key-value pairs which are only for available for Master User method.
