Embedding Reports Using Embed Tokens for Users in Bold Reports Report Server

Bold Reports supports Embed Secret Authentication, which enables applications to securely generate embed tokens for embedding reports in external applications.

Using the Embed Authentication API, applications can generate an embed token for a Report Server user without exposing user passwords. The generated token is then used by the Report Viewer to authenticate requests and render reports.

This article explains how to generate an embed token using Embed Secret Authentication and use the generated token when embedding reports in applications.

When to Use This Approach

This approach is commonly used when:

User accounts are maintained in Bold Reports.
Application users are synchronized with Bold Reports.
Report access is managed using existing Bold Reports roles and permissions.
Applications need to embed reports without exposing user passwords.
Report access should be controlled by the existing Bold Reports security model.

Practical Use Cases

Scenario	Report Server User
Application users synchronized with Bold Reports	Corresponding synchronized user
Self-service reporting portal	Corresponding user
User-specific report access	Corresponding user
Administrative reporting application	Administrator account
Shared reporting application	Reporting service account

User Synchronization Scenario

A user signs in to the application.
The application identifies the corresponding synchronized Report Server user.
The application generates an embed token using that user’s account.
The generated token is passed to the Report Viewer.
Bold Reports enforces report access based on the user’s existing permissions.

Authentication Model

In this approach, authentication and authorization are handled by Bold Reports.

The embed token is generated for a specific Report Server user. When a report is loaded, Bold Reports evaluates the roles, permissions, and resource access assigned to that user and determines which reports and resources can be accessed.

Applications do not need to implement additional authorization logic because access is controlled by the existing Bold Reports security model.

Prerequisites

Access to a Bold Reports Report Server environment.
The user account exists in Bold Reports.
An Embed Secret Key has been generated.

References

Embed Authentication API
https://help.boldreports.com/enterprise-reporting/rest-api-reference/embed-authentication/server-api-reference/#tag/Embed-Authentication
Get Embed Secret Code
https://help.boldbi.com/site-administration/embed-settings/#get-embed-secret-code

Generate an Embed Token

Endpoint

{BoldReportsUrl}/reporting/api/site/{tenant-name}/token

Example Request

{
  "grant_type": "embed_token",
  "ReportServerUser": "[email protected]",
  "Embed_Secret": "YOUR_EMBED_SECRET"
}

Request Parameter Description

Parameter	Description
grant_type	Specifies the token type. Use `embed_token`.
ReportServerUser	Report Server user account for which the embed token is generated.
Embed_Secret	Embed Secret Key associated with the user account.

Note: When using Embed_Secret, the Password field is not required.

Sample Response

{
  "access_token": "generated_embed_token",
  "token_type": "bearer",
  "expires_in": 86400
}

The returned access_token value is used as the embed token when loading reports.

Using the Generated Token in the Report Viewer

$("#report-viewer").boldReportViewer({
    reportServiceUrl: "https://yourserver/reporting/reportservice/api/viewer",
    reportPath: report_path,
    embedToken: generated_access_token
});

The Report Viewer uses the token to authenticate requests and render reports.

How Authorization Works

Bold Reports validates the embed token.
The associated Report Server user is identified.
Existing roles and permissions are evaluated.
Access is granted only to resources available to that user.

Recommended Architecture

Manage users and permissions through Bold Reports.
Generate embed tokens using Embed Secret Authentication.
Use the corresponding Report Server user when generating the token.
Avoid storing or transmitting user passwords.
Allow Bold Reports to enforce authorization using existing roles and permissions.

Best Practices

Store Embed Secrets securely.
Generate embed tokens only from trusted server-side applications.
Use HTTPS for all communication.
Avoid exposing Embed Secrets to client applications.
Follow the principle of least privilege when assigning permissions.