Generating Report Access Tokens for Embedding

This guide explains how to generate tokens to securely embed reports from our platform into your applications or web pages using an iframe.

Generating a 5-Minute Report Access Token

To embed a specific report, generate a short-lived token using your personal API token.

You’ll need:

• Your Personal API Token
• The Report ID, found in the report’s URL or via API

API Endpoint:

POST /api/reports/{report_id}/generate-token

Example: Using cURL

curl -X POST "https://pyqueryhub.com/api/reports/REPORT_ID_HERE/generate-token" \
     -H "Authorization: Bearer YOUR_PERSONAL_API_TOKEN" \
     -H "Accept: application/json"

Explanation:

• -X POST: Makes a POST request.
• Authorization: Uses your Personal API Token.
• Accept: Specifies you want JSON.

API Response (Example)

{
  "message": "Report access token generated successfully.",
  "token": "shortLivedRandomStringTokenValueGeneratedByTheApi",
  "report_id": "REPORT_ID_HERE",
  "expires_at": "2025-05-20T19:15:00.000000Z",
  "view_url": "https://pyqueryhub.com/api/reports/{REPORT_ID_HERE}/view/{shortLivedRandomStringTokenValueGeneratedByTheApi}"
}

• token: The short-lived report access token.
• view_url: Use this in your iframe src.
• expires_at: When the token expires (5 minutes).

If the request fails (e.g., invalid token or no permission), the API returns a 4xx error with a JSON explanation.

{danger} Only call this on your back-end. Keep the API Token secret

Part 3: Using view_url in an Iframe

Embed the report using the view_url:

<iframe src="PASTE_THE_VIEW_URL_HERE"
        width="100%"
        height="600px"
        frameborder="0"
        title="Embedded Report">
</iframe>

Example:

<iframe src="https://pyqueryhub.com/api/reports/REPORT_ID_HERE/view/shortLivedRandomStringTokenValueGeneratedByTheApi"
        width="100%"
        height="600px"
        frameborder="0"
        title="Embedded Report Name">
</iframe>

⚠️ The view_url expires after 5 minutes. If a user refreshes or revisits the page later, generate a new token programmatically.

Important Notes

• Security: Never expose your Personal API Token in public-facing code. Use server-side logic for token generation.
• Token Expiry: The 5-minute limit enhances security. Design your app to handle token refresh as needed.

If you encounter issues, inspect the API response or contact support.