How to show a Metabase dashboard on a TV without a login screen

Method 1Share the dashboard with a public link

A public link is a read-only URL that runs the dashboard's saved questions for anyone who has it, no login, on every edition including Metabase Cloud. Public sharing is on by default; an admin can turn it off, and can see every active link in one place.

1. Check that public sharing is enabled

   Open Grid iconAdminSettingsPublic sharing and make sure the toggle is on. The same page lists every dashboard, question and document that has a public link, with an × to revoke each one.

2. Tidy a copy for the wall

   Duplicate the dashboard and remove cards nobody reads from across a room. In the ⋯ menu at the top right choose Full width so the layout uses the whole TV instead of a centred column.

3. Create the link

   On the dashboard click Share at the top right (older versions show a sharing arrow icon instead), then Create a public link. Copy the URL. It looks like this:

   https://metabase.example.com/public/dashboard/4a3b2c1d-…

   Open it in a private browser window: the dashboard renders with no login and no Metabase navigation.

4. Pin the filters and set the look

   Filter values go in the query string, hash options after the #. A wall URL that shows the west region, hides the filter widget, refreshes every minute and uses the dark theme:

   https://metabase.example.com/public/dashboard/4a3b2c1d-…?region=west#hide_parameters=region&refresh=60&theme=night&titled=false

   Filter names are lower case with underscores instead of spaces. The full list of options is in the URL options table.

5. Later: pause or remove the link

   SharePublic linkRemove public link kills the URL; every screen using it then shows a "not found" page until you share again and update the content item in DisplayOps.

Method 2A signed static embed with locked filters

Static embedding was built for putting Metabase inside another web app, but the embed URL also opens directly in a browser, which makes it a good kiosk URL. The dashboard id and the locked filter values live inside a token signed with your Metabase secret key, so nobody can change them, and each screen can carry its own token with its own expiry. It is free on every edition; the open-source edition shows a small "Powered by Metabase" banner. Since Metabase 58 (January 2026) the docs recommend the newer guest embeds for applications and say existing static embeds keep working; see the note at the end of this method for why a screen still uses the static form.

1. Enable static embedding

   Go to SettingsAdmin settingsEmbeddingStatic and turn on Enable static embedding. Copy the Embedding secret key shown on that page; you sign tokens with it.

2. Publish the dashboard for embedding

   On the dashboard, ShareEmbedStatic embedding. For each filter choose Locked (value fixed in the token), Editable (shown on the page) or Disabled. Click Publish. Metabase shows sample server code in several languages; the Python below does the same.

3. Create a token for the screen

   Run this once per screen. The exp claim is when the wall goes dark, so choose it deliberately and write the date into the display's name in DisplayOps.

   import jwt, time   # pip install pyjwt
   
   payload = {
       "resource": {"dashboard": 12},   # the dashboard id from its URL
       "params": {"region": "west"},    # values for filters set to Locked
       "exp": int(time.time()) + 365 * 86400,   # one year; note the date
   }
   secret = "YOUR-EMBEDDING-SECRET-KEY"
   print(jwt.encode(payload, secret, algorithm="HS256"))

4. Build the URL

   Put the token in the path and the appearance options after the #:

   https://metabase.example.com/embed/dashboard/eyJhbGciOi…#theme=night&bordered=false&titled=false&refresh=60

   Opened in a private window it renders the dashboard with the locked filters applied and no way to change them.

5. Revoke when needed

   Unpublish the dashboard from the same Embed dialog to stop every token for it, or regenerate the secret key in the admin settings to invalidate every embed at once.

Method 3Make either URL private with basic auth

A public link or an embed is only as private as the URL. If Metabase sits behind a reverse proxy you run, put the wall's route behind HTTP basic auth and store the username and password on the DisplayOps content item. The screen answers the browser's prompt itself, for the page and every request it makes, and the URL alone is no longer enough to see the data. Metabase Cloud cannot be fronted this way.

1. Protect the public and embed paths at the proxy

   Hash a password with caddy hash-password, then match the two path prefixes Metabase uses for public links and embeds. Everything else, including the normal login, stays as it is:

   metabase.example.com {
     # the wall's route: public links and static embeds ask for a password
     @wall path /public/* /embed/*
     basic_auth @wall {
       lobby-tv $2a$14$Yu3…hashed-bcrypt-password…
     }
     reverse_proxy metabase:3000
   }

   The nginx equivalent uses auth_basic in a location ~ ^/(public|embed)/ block; the HTTP authentication guide has the snippet.

2. Confirm the prompt

   In a private window the public link now asks for a username and password, and loads completely once you enter them.

3. Store the credential on the content item

   When you add the URL in DisplayOps (next section), tick The page asks for a username and password (HTTP authentication) and enter the proxy user you created. Nothing goes into the URL.

URL options worth knowing

Public links and static embeds read these hash options; logged-in dashboards understand fullscreen and refresh. Combine options with &.