https://linen.dev logo
Join Discord
Powered by
Cardata Don - Hey team, We have a customer exp...
# dev-help
c
Hey team, We have a customer experiencing frequent session logouts from our ThoughtSpot embedded dashboard while they're still actively logged into our main site. We suspect there may be a token refresh or reauthentication gap on our end — possibly missing some error handling to catch when the ThoughtSpot session expires and renew it without dropping the user. Has anyone dealt with this before? Any recommended approaches for handling token expiry or session sync between the host app and the embedded TS instance?
a
message has been deleted
s
Solution: Yes—this is a common pattern, and your suspicion is right: you need SDK-driven refresh + explicit auth-failure handling. For ThoughtSpot embeds, use trusted auth with automatic renewal and handle expiry signals:
Copy code
javascript
import {
  init,
  AuthType,
  EmbedEvent,
  AuthFailureType,
  LiveboardEmbed,
} from "@thoughtspot/visual-embed-sdk";

init({
  thoughtSpotHost: "https://<your-ts-host>",
  authType: AuthType.TrustedAuthToken, // or TrustedAuthTokenCookieless
  autoLogin: true,
  getAuthToken: async () => {
    // Your backend should return a fresh TS login token for the current app user
    const res = await fetch("/api/thoughtspot/token", { credentials: "include" });
    if (!res.ok) throw new Error("Failed to fetch ThoughtSpot token");
    return res.text();
  },
});

const embed = new LiveboardEmbed("#ts-embed", {
  liveboardId: "<liveboard-guid>",
});

embed.on(EmbedEvent.AuthFailure, async (payload) => {
  // payload?.authFailureType can be EXPIRY
  if (payload?.authFailureType === AuthFailureType.EXPIRY) {
    // Optional: log/telemetry. SDK refresh flow is already triggered with autoLogin + getAuthToken.
    console.warn("ThoughtSpot auth/session expired; refresh flow triggered.");
  }
});

embed.render();
What matters most operationally: - 
autoLogin: true
 so SDK proactively renews before expiry. - 
getAuthToken
or 
authEndpoint
 must always return a valid fresh token for the currently logged-in host-app user. - For cookieless (
AuthType.TrustedAuthTokenCookieless
), token lifecycle is even more critical because token is used on subsequent requests. - Keep host-app session lifetime and TS token issuance policy aligned (avoid host app still logged-in while token service denies renewal). Suggestions: - Add telemetry around 
EmbedEvent.AuthFailure
and token endpoint failures (HTTP status, latency, user ID hash) to confirm whether drop-offs are expiry vs backend issues.
- If using cookie-based trusted auth (
TrustedAuthToken
), short token validity is okay because token is one-time for session creation; with cookieless, request longer validity. - Ensure your token service cannot be called by arbitrary clients to mint tokens for other users. - If users still see logout behavior with 
autoLogin
, check browser cookie constraints (3rd-party cookie behavior) and consider moving to cookieless auth. Docs: - Trusted auth SDK (autoLogin, token fetch flow): https://developers.thoughtspot.com/docs/trusted-auth-sdk#_overview - Token request service + token expiry behavior: https://developers.thoughtspot.com/docs/trusted-auth-token-request-service#_v2_token - Auth failure enum (
EXPIRY
): https://developers.thoughtspot.com/docs/Enumeration_AuthFailureType#_expiry - Auth overview: https://developers.thoughtspot.com/docs/embed-auth
y
Hey @Cardata Don - please refer to the docs above. or simply putting it -> getAuthToken handle re-auth automatically with autoLogin=true, so, you just need to provide endpoint which fetches token from thoughtspot. If you have added some validity and want to cache in backend that's also possible. If you want to check something more. Please paste your code snippet for init() and where init is placed, I can take a look and help out if something is missing. Thanks.
l
@yuichirio_ha see snippet below:
y
Hey @ltang_cd , this looks good -> can you check in console if you getting any error for duplicate token or something. As well - do check what your endpoint returning each time. Your backend should just be calling the token/full, token/custom - from thoughtspot direclty not reusing the old token if that is stale token - it will logout the session from frontend. If you want caching on backend then you can add caching but need to refresh before timeout for which you have added token in backend. ( if you are unsure pls paste backend code quick Someone can check and suggest if something missing ) Thanks.
c
Hey @yuichirio_ha thank you for the suggestions. We updated our code and it worked for a few weeks but the same driver is now logged of ThoughtSpot out again within our application - Below is the update we made, is there any other suggestion you have?
@extends('layouts.master-new', ['bodyDto' => $bodyDto]) @section('content') @include('partials.sidebar', ['sidebarDto' => $sidebarDto]) @include('partials.nav-header', ['headerDto' => $headerDto]) @include('partials.sub-header', ['subHeaderDto' => $subHeaderDto]) iframe:focus-visible { outline: none; } import { LiveboardEmbed, AuthType, init, Action, } from 'https://cdn.jsdelivr.net/npm/@thoughtspot/visual-embed-sdk@1.37.1/+esm'; init({ thoughtSpotHost: 'https://cardata.thoughtspot.cloud', authType: AuthType.TrustedAuthTokenCookieless, autoLogin: true, getAuthToken: () => { return fetch('{{ $token_uri }}', { credentials: 'include', headers: { Authorization: 'Bearer {{ $token }}' }, }) .then((response) => { if (!response.ok) { throw new Error('Failed to fetch ThoughtSpot token'); } return response.json(); }) .then((data) => data.token); }, customizations: (...)
PreviousNext
Powered by