Generate Embed Token Using Embed Secret and Pass User Context to Reports with Custom Attributes and Report Parameters in Bold Reports

When embedding reports into your application, it is common to manage users, roles, permissions, and business-specific configuration entirely within the application itself. In this approach, users sign in using the organization’s existing authentication mechanism, while the application determines what information each user is authorized to access.

Bold Reports supports this architecture by allowing applications to securely access reports without requiring every application user to exist in the Report Server. Although a ReportServerUser is required during embed authentication, individual application users do not need to be created in Bold Reports.

The Report Server manages report resources, data processing, report execution, and rendering, while your application continues to manage authentication and authorization. During embed token generation, application-specific and user-specific context can be passed through Custom Attributes and Report Parameters. These values may represent Tenant ID, Customer ID, Employee ID, Department ID, Region, Branch ID, Database Name, API Authentication Token, Organization Code, Business Unit, or any other identifier required by your reporting architecture.

Prerequisites

Access to a Bold Reports Report Server environment.
An Embed Secret Key has been generated.

References

Embed Authentication API
https://help.boldreports.com/enterprise-reporting/rest-api-reference/embed-authentication/server-api-reference/#tag/Embed-Authentication
Get Embed Secret Code
https://help.boldbi.com/site-administration/embed-settings/#get-embed-secret-code

Practical Use Cases

Scenario	Value Passed
Multi-tenant SaaS application	Tenant ID
Customer portal	Customer ID
Employee self-service application	Employee ID
Department-based reporting	Department ID
Regional reporting application	Region
Branch-based reporting	Branch ID
Database-per-customer architecture	Database Name
API-based data source integration	API Authentication Token
Enterprise applications	Organization Code or Business Unit

Generate an Embed Token

Endpoint

{BoldReportsUrl}/reporting/api/site/{tenant-name}/token

Example Request

{
  "grant_type": "embed_token",
  "ReportServerUser": "[email protected]",
  "Embed_Secret": "your-embed-secret",
  "ReportParameters": [
    {
      "Key": "FiscalYear",
      "Values": ["2026"]
    }
  ],
  "CustomAttributes": [
    {
      "Key": "TenantId",
      "Value": "TENANT001"
    },
    {
      "Key": "ApiAuthenticationToken",
      "Value": "generated-api-token"
    }
  ]
}

Sample Response

{
  "access_token": "generated_embed_token",
  "token_type": "bearer",
  "expires_in": 86400
}

Sample Token Generation Response

Successful embed token generation response

The value returned in the access_token field is used as the embedToken while loading reports in the Bold Reports Viewer.

Using the Generated Token in the Report Viewer

$("#report-viewer").boldReportViewer({
    reportServiceUrl: "http://reportserver.syncfusion.com/ReportService/api/Viewer",
    reportPath: report_path,
    embedToken: generated_access_token
});

Passing User Context Through Custom Attributes

Common examples include:

Tenant ID
Customer ID
Employee ID
Department ID
Region
Branch ID
Database Name
Organization Code
Business Unit
API Authentication Token

API Data Source Scenario

{
  "Key": "ApiAuthenticationToken",
  "Value": "generated-api-access-token"
}

When using API data sources, the custom attribute can be consumed during dataset execution to authenticate requests against external APIs and retrieve tenant-specific or user-specific data.

Reference:
https://help.boldreports.com/enterprise-reporting/designer-guide/report-designer/manage-data/dataset/configure-custom-attribute/

Using Report Parameters for Report Filtering

Typical examples include:

Fiscal Year
Date Range
Currency
Country
Business Unit
Product Category
Language

Reference:
https://help.boldreports.com/embedded-reporting/javascript-reporting/report-viewer/report-parameters/

https://help.boldreports.com/enterprise-reporting/designer-guide/report-designer/report-parameters/add/

Recommended Architecture

Manage users and permissions within your application.
Generate embed tokens using a dedicated Report Server user and Embed Secret.
Pass application-specific and user-specific context through Custom Attributes.
Use Custom Attributes for tenant isolation, API authentication, row-level security, and dynamic data routing.
Use Report Parameters for report filtering requirements.
Configure datasets to consume these values and return only authorized data.