Embedded dashboard shows chart action menu (3-dots). How to hide it in read-only mode?

[damodhar-admin]

Bug description

Hi,
I am embedding a Superset dashboard using a permalink inside an iframe:

<iframe src="https:///superset/dashboard/p//?standalone=1" width="100%" height="900"> </iframe>

The dashboard loads correctly, but inside the embedded view, every chart still shows the 3-dots action menu (Edit Chart, View Query, Share, Export, etc.).

I want the embedded dashboard to be fully read-only, so that users cannot see any edit or query options.

What I tried:

Using standalone=1 / 2 / 3
Using permalink URL and normal dashboard URL
Setting allowed domains in Embed settings
Testing in incognito (not logged in)

Still the chart action menu appears.

Request;
What is the correct way to hide the chart action menu (3-dots) when embedding a Superset dashboard in an iframe?
Is iframe embed supported for read-only mode, or should I use the Embedded SDK + guest token?

Thanks.

Screenshots/recordings

No response

Superset version

master / latest-dev

Python version

3.9

Node version

16

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

There isn't a built-in way to hide the chart action menu (3-dots) in embedded dashboards using iframe embedding or the standalone parameter. The menu's visibility is controlled by frontend logic and user permissions, not by embedding context or URL parameters. To achieve a true read-only embedded dashboard (with chart actions hidden), you need to use the Embedded SDK with guest tokens and configure a custom read-only role via the GUEST_ROLE_NAME setting in superset_config.py reference.

Here's how you can do it:

1. Create a custom role with only read permissions (start from the Gamma role and remove any permissions that allow editing, like can_explore) reference.
2. Set GUEST_ROLE_NAME to your custom role in superset_config.py and restart Superset reference.
3. Use the Embedded SDK to embed your dashboard and authenticate with a guest token. The SDK also supports UI options like hideTitle, hideTab, and hideChartControls for further customization reference.

Loading a dashboard in an iframe without a guest token logs the user in as an anonymous user, so chart actions remain visible. There is no configuration to automatically treat iframe users as guest users or to hide the chart action menu without the guest token mechanism reference.

CSS workarounds exist but are not recommended, as they don't remove permissions and may cause layout issues reference.

For more details, see these discussions:

• How to disable Edit Chart in embedded dashboards
• Guest token embedding and permissions
• Why iframe embedding doesn't enforce read-only

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[damodhar-admin]

@dosu
Thanks for the explanation.
I followed the recommended approach using the Embedded SDK + guest tokens, but the SDK embedding is still not working for me. Could you please share the exact steps or a working example?

Here is what I already tried:

Created a custom read-only role starting from Gamma and removed all editing permissions (can_explore, export, edit, SQL, etc.).

Set GUEST_ROLE_NAME = "guest_readonly" and added a valid GUEST_TOKEN_JWT_SECRET in superset_config.py, then restarted Superset.

Enabled Embedded Superset and added my domain in Allowed Domains.

Generated a guest token from my backend (JWT with HS256).

Used supersetEmbeddedSdk.embedDashboard() with:

id: <dashboard_id>

supersetDomain pointing to my Superset instance

fetchGuestToken is returning my token

dashboardUiConfig.hideChartControls = true

Even after doing this, the dashboard is not loading properly with SDK.

Can you please share:

A minimal working example

Required permissions list for the read-only role

Any additional configuration needed on the Superset side

Common mistakes that can prevent SDK embedding from working

Thanks in advance.

[dosubot]

Here’s a concise guide for embedding Superset dashboards with the Embedded SDK and guest tokens:

Minimal working example:

import { embedDashboard } from "@superset-ui/embedded-sdk";

embedDashboard({
  id: "<dashboard_id>", // UUID from Superset's embed UI
  supersetDomain: "https://your-superset-domain.com",
  mountPoint: document.getElementById("superset-container"),
  fetchGuestToken: () => fetchGuestTokenFromBackend(), // async function returning the JWT
  dashboardUiConfig: {
    hideTitle: true,
    hideTab: true,
    hideChartControls: true,
    filters: { visible: false, expanded: false },
  },
  iframeSandboxExtras: ["allow-top-navigation", "allow-popups-to-escape-sandbox"],
  referrerPolicy: "same-origin",
});

Reference

Guest token payload example:

{
  "user": { "username": "viewer" },
  "resources": [{ "type": "dashboard", "id": "<dashboard_id>" }],
  "rls": [],
  "iat": 1730883214,
  "exp": 1732956814,
  "aud": "superset",
  "type": "guest"
}

Reference

Required permissions for the read-only role:
Grant only these permissions to your custom guest role (start from Gamma, remove all edit/export/SQL permissions):

• can_read, can_list, can_show, can_get, can_external_metadata on: Dashboard, Chart, Dataset, Database, SavedQuery, Query, Embedded Dashboard
• can dashboard and can explore json on Superset
• can time range on Api
• can read on DashboardPermalinkRestApi, ExploreFormDataRestApi, ExplorePermalinkRestApi
• can_access on Superset (needed for /superset/log endpoint)
  Reference

Superset-side configuration checklist:

• Enable the feature flag: EMBEDDED_SUPERSET = True in superset_config.py or .env
• Set a strong GUEST_TOKEN_JWT_SECRET and matching GUEST_TOKEN_JWT_AUDIENCE
• Set GUEST_ROLE_NAME = "guest_readonly" (or your custom role name)
• Add your embedding domain to allowed domains in the dashboard embed settings
• Enable CORS: ENABLE_CORS = True and configure CORS_OPTIONS
• Set up Content Security Policy for iframe embedding:

  TALISMAN_ENABLED = True
  TALISMAN_CONFIG = {
      "content_security_policy": {
          "frame-ancestors": ["https://your-embedding-domain.com"],
      }
  }

• Restart Superset after config changes
  Reference

Common mistakes and troubleshooting:

• Guest token missing required claims (user, resources, rls_rules, type: guest)
• Dashboard ID not included in the guest token or in chart data requests (causes 403 errors)
• GUEST_ROLE_NAME not set or not matching your custom role
• Embedding domain not listed in allowed domains or CSP frame-ancestors
• CORS or X-Frame-Options headers blocking iframe embedding
• Guest user listed as chart owner (can cause edit options to appear)
• Charts missing query_context field (visit chart edit page in Superset to populate)
• Token expired (GUEST_TOKEN_JWT_EXP_SECONDS too short)
  Reference

If you hit errors like "Guest user cannot modify chart payload," check that all charts have a populated query_context field and that your guest token is correctly scoped.

Let me know if you need more details on any step!

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[damodhar-admin]

I have one clarification:

Is the backend token endpoint mandatory in order to use the Embedded SDK?
From what I understood, the SDK requires a valid guest token (JWT) that is signed using the GUEST_TOKEN_JWT_SECRET, and Superset will not generate this token by itself.

If this is correct, then I need to generate the guest token from my backend application (Next.js).
In that case, can you please confirm if this is the required approach:

1. Create a backend API endpoint to generate guest tokens

For example, in Next.js:

// /api/superset-token
import jwt from "jsonwebtoken";

export default function handler(req, res) {
const payload = {
user: { username: "viewer" },
resources: [{ type: "dashboard", id: "<dashboard_id>" }],
rls: [],
type: "guest",
aud: "superset",
};

const token = jwt.sign(
payload,
process.env.SUPERSET_SECRET, // Same as GUEST_TOKEN_JWT_SECRET
{ algorithm: "HS256", expiresIn: "10m" }
);

res.status(200).send(token);
}

2. Pass this token to the Embedded SDK

fetchGuestToken: () =>
fetch("/api/superset-token").then((res) => res.text()),

3. Superset validates the token and loads the dashboard in read-only mode

Please confirm if this backend token endpoint is indeed required and whether this implementation aligns with Superset’s recommended approach for embedded dashboards.

Thanks!

[msyavuz]

I'll take a look at this but as far as i know there is no way to do this yet. If so we will probably move this to a discussion/feature request and go from there. @Vitor-Avila Any ideas on how this should go? Should we enable some configs in the sdk or just determine if a chart is in embedded mode a bit more precisely?

[Vitor-Avila]

@msyavuz this is actually already possible in the SDK via the dashboardUiConfig parameters.

It seems the user is already using it, but facing issues to use the SDK.

@damodhar-admin yes, you need a valid guest token to authenticate the iframe requests. You could have your host app just return a static guest token, but that's not a safe approach because you want your guest tokens to be short lived so that a user inspecting the browser can't use it to fetch data again in the future. The endpoint allows you to generate them often and etc. You can definitely use a static token for testing, but make sure it's not expired