Embed tokens

Embed tokens is the register of tokens minted to put your saved queries and dashboards on other people’s web pages. One row per token, with a Revoke button.

Embed tokens are the widest-reaching credential Saiku issues — they’re designed to travel through host pages you don’t control, and whoever loads the page can read what the token grants. This page is where you keep track of them.

What’s on the page

Column	What it tells you
Token	The visible prefix. Enough to match a row against a token you’re holding, without printing the secret.
Resource	The saved query or dashboard the token reaches. Each token grants exactly one.
Redaction policy	Default or a Forced chip — see below.
Status	active, expired, or revoked.
Expires	When it lapses on its own.
Created by	Who minted it.

The Forced chip

A token marked Forced applies maximum-strength PII redaction on every read, regardless of your tenant’s tier setting.

You don’t opt into this — Saiku decides at mint time. If the query or dashboard reads a column annotated saiku.semantic.pii, the token is elevated automatically, and a relaxed workspace default won’t lower it for that one resource.

Note

It also fails safe. If Saiku can’t resolve the resource well enough to be certain, it elevates anyway. So an unexpected Forced chip more often means “we couldn’t tell” than “this is full of personal data” — but it’s the right way round for a credential that ends up on a public page.

Revoking

Revoke kills the token immediately. The next read through it fails, and any page embedding it shows an error rather than stale data — there’s no cached session to keep it alive. No undo.

Tokens also expire on their own, at whatever TTL they were minted with (72 hours by default, 30 days at most). A short TTL is the better habit; revocation is for when you can’t wait.

Worth a pass whenever:

• A page or campaign that embedded a dashboard has come down.
• Someone who minted tokens has left.
• You see a token whose resource you don’t recognise.

Minting

You don’t mint tokens here — this page audits them. They’re created from the Saiku UI when you embed a query or dashboard, or programmatically over the API.

The Embedding Saiku page covers both: the <saiku-embed> tag, the mint call and its redactionPolicy response field, TTL bounds and per-user limits, and the anonymous public-embed path for content that shouldn’t need a token at all.

Related

• Embedding Saiku — minting, the embed tag, and the security model.
• Semantic annotations — marking a column as PII, which is what drives the Forced chip.
• API keys — credentials for agents, as opposed to embedded pages.
• Audit log — reads made through your tokens.