Signed embeds

Signed embeds place an approved dashboard or data app inside another product without exposing Answerplane credentials.

Server-side flow

Your backend authenticates the product user, authorizes the requested resource and tenant, then creates a short-lived signed embed token. The browser receives only that limited token.

const response = await fetch(`${process.env.ANSWERPLANE_API_URL}/api/embed/token`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ANSWERPLANE_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ resourceId, tenantId, origin }),
});

Confirm the exact endpoint and payload in the API reference.

Controls

• allow only expected production origins
• use short token lifetimes
• bind the token to one resource and audience
• derive tenant scope from the authenticated server session
• show a clear expired-session state

Migration note

The retired general-purpose chat widget is not the recommended integration. Use signed dashboards or data apps so the exposed capability and tenant boundary are explicit.