Appearance
Secure Embedding
Embed Taufinity Studio's full portal directly inside your own product — dashboards, playbooks, content, and more — without sending your users through a separate login screen.
Enterprise feature
Secure embedding is available for Enterprise customers and is currently set up by the Taufinity team as part of onboarding — there's no self-service toggle yet. Contact us to enable it for your product.
How it works
- Your backend — which already knows and trusts its own logged-in user — calls a Studio API using your organization's API key, naming the user's email and which part of Studio they should see.
- Studio returns a one-time claim token.
- Your app renders that token inside an iframe pointed at Studio. Studio verifies the token, signs the user in, and shows exactly the scoped view your organization has granted — no visible login screen inside the iframe.
If you'd rather not wire up the server-to-server call, embedding Studio's normal login screen inside an iframe works too — your user signs in as they normally would, without leaving your app.
What you get
- No separate login. Users authenticate once, in your app; Studio trusts that via a signed, single-use token — never a shared password or session.
- Scoped by design. Embedded users only ever see the client group or data your organization has explicitly granted, enforced server-side regardless of what the frontend shows.
- Full portal, not a subset. Dashboards, playbooks, content — the same navigation your own team already uses in Studio directly.
New users and approval
The first time someone is embedded who hasn't used Studio before, their account is created automatically but starts in a pending state — the same approval step as Enterprise SSO. A Studio admin on your side approves the request, and your organization's admins are notified by email as soon as someone's waiting. Once approved, that person's embedded sessions go straight to the dashboard from then on — no repeat approval.
Setting it up
Secure embedding is configured per organization by the Taufinity team:
- Allowed origins — which of your domains are permitted to embed Studio in an iframe
- An API key — scoped to only the embed-token endpoint, nothing else
- Which data is visible — the specific client group or scope your embedded users see
Get in touch and we'll walk through what your team needs to integrate.
Security model
| Property | Detail |
|---|---|
| Authentication | Server-to-server, using your organization's own API key — never a shared password |
| Session tokens | Single-use, short-lived claim tokens; a replayed token is rejected |
| Framing | Explicit allowlist per organization — embedding is opt-in, denied by default for every organization |
| Scope | Restricted to the client group or data your organization has granted — never cross-organization |
| Fallback | If no token is presented, Studio's normal login screen renders inside the iframe instead of failing |