Authenticate Server-Side REST API Requests Using Embed Secret Authentication in Bold Reports
Bold Reports provides an Access Token Authentication API that enables server-side applications to securely access Bold Reports REST API resources. Applications can authenticate using Embed Secret Authentication and obtain an access token that can be used for subsequent REST API requests.
When to Use This Approach
Embed Secret Authentication is recommended for server-side scenarios where applications need to communicate with Bold Reports REST APIs securely.
Typical use cases include:
- Creating and managing users.
- Creating and managing groups.
- Assigning permissions.
- Retrieving reports and categories.
- Managing datasets and data sources.
- Downloading report definitions.
- Automating deployment tasks.
- Tenant onboarding and provisioning.
- Integrating business applications with Bold Reports.
Prerequisites
- Access to a Bold Reports Report Server environment.
- A valid Bold Reports user account.
- An Embed Secret Key.
- Ability to make HTTPS requests to the Bold Reports REST API.
Choosing the Appropriate User Account
| Scenario | Recommended Account |
|---|---|
| Tenant onboarding | Administrator or Service Account |
| User provisioning | Administrator or Service Account |
| Group creation | Administrator or Service Account |
| Permission assignment | Administrator or Service Account |
| Deployment automation | Administrator or Service Account |
| User-specific API operations | Synchronized Bold Reports User |
| Retrieving user reports | Synchronized Bold Reports User |
Generate an Access Token
Endpoint
{BoldReportsUrl}/reporting/api/site/{tenant-name}/token
Example Request
{
"username": "[email protected]",
"Embed_Secret": "YOUR_EMBED_SECRET",
"grant_type": "Embed_Secret"
}
Sample Response
{
"email": "[email protected]",
"username": "[email protected]",
"access_token": "generated_access_token",
"token_type": "bearer",
"expires_in": "86400"
}
Using the Access Token
Authorization: Bearer generated_access_token
Example:
GET https://yourserver/reporting/api/site/site1/items
Authorization: Bearer generated_access_token
Best Practices
- Generate access tokens only from trusted server-side applications.
- Never expose Embed Secrets in client-side applications.
- Use dedicated service accounts for onboarding and provisioning workflows.
- Use HTTPS for authentication and API communication.
- Implement token renewal when tokens expire.
References
-
Access Token Authentication
https://help.boldreports.com/enterprise-reporting/rest-api-reference/v5.0/server-api-reference/#tag/Access-Token-Authentication -
Bold Reports REST API Reference
https://help.boldreports.com/enterprise-reporting/rest-api-reference/v5.0/server-api-reference/ -
Get Embed Secret Code
https://help.boldbi.com/site-administration/embed-settings/#get-embed-secret-code
