---
url: 'https://docs.codatum.com/features/notebook/sharing/signed-embed/overview.md'
description: >-
  Signed embed for embedding a notebook into an external app with an API key and
  token
---

# Signed embed (Optional feature)

A signed embed is a feature for embedding the content of a notebook, at the time it was published, into an external site or app. It's used together with the embedding destination's own authentication system, and doesn't require logging in to Codatum. Authentication uses an [API key](../../../../workspace/access-and-security/api-key) and a token issued server-side.

Viewers can change parameters and re-run SQL. Downloads and the Explorer are controlled by publish options. Comments aren't available. See [Sharing](../overview#comparison) for a comparison of sharing methods.

For integration steps, see [Integration steps](./integration). For data isolation per tenant, see [Multi-tenant](./multi-tenant). For embedding on the frontend, you can use the [Codatum Embed SDK](https://github.com/codatum/codatum-embed-js) (`@codatum/embed` / `@codatum/embed-react` / `@codatum/embed-vue`).

::: tip
This is an **optional feature**. Depending on your contract, it might not be available.
:::

## Key features

* [Publishing](#publish) / [Settings](#settings)
* [Integration steps](./integration)
* [Token issuance API](./issue-token)
* [Multi-tenant](./multi-tenant)
* [Use cases](./use-case)
* [FAQ](./faq)

## Publishing {#publish}

Publishing requires publish permission on the source notebook, and publish permission on the connections used by the pages being published. Notebooks accessed through a shared folder can't be published.

1. Open **Share** on the notebook screen, then select the **Signed embed** tab.
2. Select **Create signed embed**.
3. Configure the following, then select **Publish**.

| Item {.nowrap} | Description |
| --- | --- |
| **Signed embed name** | The name of the embed. Defaults to the notebook name. You can also set an icon. |
| **Published pages** | The pages to publish. At least one page other than a **section divider** is required. Defaults to all pages. |
| **Embedded connections** | Automatically extracted from the pages being published. Publish permission on the target connections is required. |
| **Enable downloads** | Lets embed viewers download the source data. Disabled by default. |
| **Enable Explorer** | Lets embed viewers explore the source data. Disabled by default. |

After publishing, you can do the following from the list.

* Open the settings/preview screen from the name or **Settings**.
* **Publish changes**: reflects changes to the notebook or to publish options.
* **Compare with current notebook**
* **Delete**

Changes to the notebook itself aren't automatically reflected. You need **Publish changes** to reflect them. Changing downloads or the Explorer also requires republishing.

## Settings {#settings}

On the settings screen, you can change the following.

| Item {.nowrap} | Description |
| --- | --- |
| **Signed embed name** | The display name of the embed. |
| **API keys granted permission** | The API keys that can be used to issue tokens. At least one is required. |
| **Server-side parameters** | Parameters whose value is specified server-side when issuing a token. Parameters not specified here become client-side parameters. |
| **Allowed origins** | The origins allowed to embed. Specify values starting with `http://` or `https://`. If unset, embedding is allowed from any origin. |
| **Publish options** | The download and Explorer settings. Changing these requires republishing. |

### Server-side parameters {#server-side-params}

For each parameter, you can choose one of the following.

| Type {.nowrap} | Description |
| --- | --- |
| **Fixed value** | A value fixed server-side. Users can't change the value, and the input field is also hidden. When a [parameter placed on a grid page](../../grid-page/overview#parameter-component) is referenced by SQL or charts on this page, its tile is displayed as read-only. |
| **Initial value** | Sets an initial value, but users can change the value from the frontend's input field. |

Changing a fixed value requires reissuing the token. See [Multi-tenant](./multi-tenant) for details.

## Specification {#spec}

* The default token expiration is 3600 seconds (1 hour); the maximum is 86400 seconds (see [Limits](../../../../reference/limits#fixed-limits)).
* If `cache_max_age` is omitted, the default is 86400 seconds. The maximum is also 86400 seconds.
* The number you can create has a limit that depends on your contract (see [Limits](../../../../reference/limits#plan-limits)).
* The **Signed embed** tab is shown when the signed embed feature is enabled for the workspace.

## When you can't publish {#cannot-publish}

Check the following.

1. Whether you have publish permission on the source notebook (notebooks accessed through a shared folder can't be published).
2. Whether you have publish permission on the connections used by the pages being published.
3. Whether you've reached the limit on the number of signed embeds (global nav > **Workspace settings** > **Usage**).