Pro · Lesson 7 of 9
Signed-in sharing, public links, and embedding move the same rows to different audiences.
Sign in to save your place.
Sharing with a signed-in colleague is handing them a key to a room they are allowed to enter. A public link is leaving the door open and posting the address. Embedding is putting one window of that room inside another building. The window still shows real rows.
A collection share lets another Metabase user open the question or dashboard. Their group permissions still apply. This is the default you want inside a company.
A public link and a public embed have no login. Anyone with the URL can see the result. Turn public sharing off unless the data is already public. If you enable it for one chart, check the filters. A public dashboard filter can let a stranger pivot into columns you did not mean to publish.
Signed embedding puts a chart in your own application. Your server signs a token with the embedding secret. The browser receives the token. It must not receive the secret. Interactive embedding and the embedded analytics SDK, which let people explore inside your product, are paid features. Confirm the plan before you promise them.
| Method | Who can open it | Secret involved |
|---|---|---|
| Collection permission | Signed-in people in the right group | Their Metabase login |
| Public link | Anyone with the URL | None. That is the risk |
| Static embed | Whoever your app gives a token | Embedding secret stays on the server |
| Interactive embed or SDK | People in your app, with more exploration | Paid plan, plus the signing secret |
An embed can pass parameters, such as a customer id, and lock them so the viewer cannot switch to another customer. If you leave the parameter editable, the chart is only as private as the viewer's curiosity. Test with a token for customer A and confirm customer B's rows do not appear.
# The shape of a signed embed. Sign this on the server.
# Never put METABASE_EMBEDDING_SECRET in frontend code.
# payload: resource dashboard id, params, expiryRow-level sandboxes and collection permissions do not protect a public URL. If the chart must stay inside the company, do not publish it.
Three doors, each with a different level of control over who can see what.
Step 1 of 3People who sign in see only the collections and data their groups allow.
Admin → People → add to group ‘Sales’
Step 2 of 3A public link works without logging in. An admin must enable it, and you cannot limit it to particular people, so never use it for private data.
Sharing → Create a public link
Step 3 of 3Embedding puts a chart inside your own app. With signed embedding, your server signs a token that locks filters, so each customer sees only their own rows.
Sharing → Embed → Locked parameter: customer_id
List one question that is safe to show a signed-in colleague and one that must never have a public link. If you enable embedding in a trial, create the token on a server you control and set an expiry. Then disable public sharing again if you turned it on to look.
Checked against vendor documentation in October 2026. Screens and plan names still change, so confirm the control in your own instance.