Grafana Public Dashboard Sharing Mechanism: Architecture and Implementation

Grafana's public dashboard sharing mechanism creates lightweight access tokens linked to existing dashboards, enabling anonymous read-only access through a dedicated service layer while maintaining security via feature flags and middleware validation.

Grafana's public dashboard sharing feature allows users to expose dashboards to external viewers without requiring authentication. Implemented in the grafana/grafana repository, this mechanism relies on a token-based architecture that bridges private dashboards with public accessibility through a specialized service layer.

Core Architecture and Data Model

The foundation of Grafana's public dashboard sharing resides in the dashboard_public database table, defined in pkg/services/publicdashboards/models/models.go. Each public dashboard record creates a lightweight proxy for an existing dashboard, storing critical metadata that controls access and behavior.

The data model includes:

• Uid: Unique identifier for API operations
• AccessToken: Cryptographically random token granting anonymous access
• IsEnabled: Boolean flag to toggle public availability
• Share: Configuration for email or public sharing modes
• TimeSelectionEnabled and AnnotationsEnabled: UI customization flags

Feature Gating and Security Controls

Access to public dashboard functionality is controlled through configuration flags registered in pkg/api/api.go. The cfg.PublicDashboardsEnabled flag governs the entire feature, while FeaturePublicDashboardsEmailSharing manages email-specific sharing capabilities. These gates ensure that organizations can control public exposure according to their licensing and security requirements.

Management API for Public Dashboards

Authenticated users manage public dashboards through a comprehensive REST API defined in pkg/services/publicdashboards/api/api.go. The API supports full lifecycle management:

1. List: GET /api/dashboards/public-dashboards retrieves all public dashboards
2. Get: GET /api/dashboards/uid/:dashboardUid/public-dashboards fetches specific configuration
3. Create: POST /api/dashboards/uid/:dashboardUid/public-dashboards generates new public access (handler CreatePublicDashboard at lines 81-100)
4. Update: PATCH /api/dashboards/uid/:dashboardUid/public-dashboards/:uid modifies settings
5. Delete: DELETE /api/dashboards/uid/:dashboardUid/public-dashboards/:uid revokes access

Creating a Public Dashboard via API

curl -X POST https://grafana.example.com/api/dashboards/uid/abcd1234/public-dashboards \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{
        "uid": "",
        "accessToken": "",
        "timeSelectionEnabled": true,
        "isEnabled": true,
        "annotationsEnabled": false,
        "share": "public"
      }'

The handler CreatePublicDashboard validates the payload and calls PublicDashboardService.Create which generates a UID and access token in pkg/services/publicdashboards/service/service.go (lines 217-250).

Anonymous Access and Viewing Flow

Public viewers access dashboards through a specialized route that bypasses standard authentication. The URL pattern follows:

https://<grafana-host>/public-dashboards/<accessToken>

This route is registered in pkg/services/frontend/frontend_service.go (line 188). The middleware SetPublicDashboardAccessToken in pkg/services/publicdashboards/api/middleware.go (lines 31-34) extracts the token and attaches it to the request context.

The service method GetPublicDashboardForView in pkg/services/publicdashboards/service/service.go (lines 88-118) validates the token, retrieves the underlying dashboard, and injects public-specific configurations such as time picker visibility and read-only flags before rendering.

Query Handling for Public Panels

When anonymous users interact with dashboard panels, the system processes queries through a dedicated endpoint. The route POST /public-dashboards/:accessToken/panels/:panelId/query is handled by QueryPublicDashboard in pkg/services/publicdashboards/api/api.go (line 74).

Internally, PublicDashboardService.Query in pkg/services/publicdashboards/service/query.go (lines 146-170) constructs the metric request. This process strips user-specific authentication context and enforces read-only constraints, ensuring that public viewers cannot execute arbitrary queries or access data outside the shared dashboard scope.

Querying a Public Panel

curl -X POST https://grafana.example.com/public-dashboards/6f4a9b8c9e5f/panels/2/query \
  -H "Content-Type: application/json" \
  -d '{
        "intervalMs": 10000,
        "maxDataPoints": 500,
        "timeRange": {"from":"now-6h","to":"now"}
      }'

Summary

• Grafana's public dashboard sharing creates lightweight proxy records in the dashboard_public table, linking existing dashboards to unique access tokens.
• The feature is gated by PublicDashboardsEnabled configuration and optional email-sharing license flags.
• Management occurs through authenticated REST endpoints in pkg/services/publicdashboards/api/api.go, supporting full CRUD operations.
• Anonymous access flows through /public-dashboards/:accessToken, validated by middleware in pkg/services/publicdashboards/api/middleware.go and rendered via GetPublicDashboardForView.
• Query handling strips authentication context and enforces read-only constraints through PublicDashboardService.Query.

Frequently Asked Questions

How does Grafana generate the access token for public dashboards?

Grafana generates the access token cryptographically within the service layer. When creating a public dashboard via CreatePublicDashboard in pkg/services/publicdashboards/service/service.go (lines 217-250), the system generates a random string for the AccessToken field if not provided. This token is stored in the dashboard_public table alongside the dashboard UID and serves as the sole credential for anonymous access.

Can public dashboards be disabled without deleting them?

Yes. The IsEnabled boolean field in the dashboard_public table allows administrators to toggle public availability without removing the configuration. Updating this field via the PATCH endpoint UpdatePublicDashboard in pkg/services/publicdashboards/api/api.go immediately disables public access while preserving the access token and settings for future re-enabling.

What security measures prevent public dashboard viewers from accessing other data?

Multiple layers enforce data isolation. The middleware SetPublicDashboardAccessToken in pkg/services/publicdashboards/api/middleware.go extracts and validates the token before any data access occurs. The query handler PublicDashboardService.Query in pkg/services/publicdashboards/service/query.go explicitly strips user authentication context and constructs metric requests with read-only constraints, ensuring viewers cannot query datasources outside the shared dashboard scope or execute write operations.

Where is the public dashboard feature flag configured?

The feature flag PublicDashboardsEnabled is registered in pkg/api/api.go as part of Grafana's configuration system. Administrators enable the feature by setting this configuration value, which unlocks the management API endpoints and public viewing routes. Additionally, the FeaturePublicDashboardsEmailSharing license flag controls email-specific sharing capabilities, checked throughout the service layer in pkg/services/publicdashboards/service/service.go.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}