Re: How to auto generate embed token using javascr...

Deep · ‎12-11-2020

I successfully embed a report into my application using javascript. But I have to update embedded token manually every time.

Now I want to call rest API from my code so that token update automatically.
How to call API from my code to generate token and how to update token when it's going to expire?

My code is :

<html>

<head>

</head>

<body>

<h1>Power BI Embed test</h1>

</div>

</div>

(function () {

// Please change these values

var txtAccessToken = 'H4sIAAAAAA...';

var txtEmbedUrl =

'https://app.powerbi.com/reportEmbed?reportId=b21f4f90-e364-4b4c-9281-c5db87cdf3a5&groupId=a4781858-f...';

var txtEmbedReportId = 'b21f4f90-e364-4b4c-9281-c5db87cdf3a5';

var models = window['powerbi-client'].models;

var permissions = models.Permissions.All;

var config = {

type: 'report',

tokenType: models.TokenType.Embed,

accessToken: txtAccessToken,

embedUrl: txtEmbedUrl,

id: txtEmbedReportId,

permissions: permissions,

settings: {

filterPaneEnabled: true,

navContentPaneEnabled: true

}

};

var embedContainer = document.getElementById('embedContainer');

var report = powerbi.embed(embedContainer, config);

}());

</script>

</body>

</html>

TedPattison · ‎02-11-2021

In general, it is insecure to generate embed tokens directly from the client. To do so you would need to pass a highly-priveldged access token back to the browser which is big security risk. Instead, create an server-side API for embed token renewal and have code in the browser call this servier-side API. With this design the application secret for your Azure AD application and the highly-priveldged access tokens all remain on the server and are never passed to the browser. Yes, it is more work but it's the only way to maintain a secure application.

qiushi_zhai · ‎02-09-2021

Yes, I'm also looking for a solution to this problem

Gabriel_Walkman · ‎02-02-2021

Not sure if this works anymore, but here goes: https://community.powerbi.com/t5/Developer/get-Access-token-using-js/m-p/350294

Deep · ‎02-07-2021

yes, I do that but there is a problem over there. We made this solution for almost 1000 users so I want to remove that login popup because I don't want to share credentials with every user. Is there any solution for that?