Put spreadsheets your users control inside your product

One Docker command, or PHP and MySQL on ordinary hosting - see Download. Log in as the administrator you created. (2 minutes)

An embed token always names a real Artavolo user, and can never do more than that user may. Create one on purpose - Administration → Members - for example embed@yourcompany.com, then open the base you want to embed and give that user exactly the access your customers should have: read-only, or contributor. (3 minutes)

Administration → Settings → Embedding: tick Accept embed tokens, add the address your application runs on under Allowed host origins (for example https://app.yourcompany.com, or http://localhost:3000 while you develop), and copy the signing secret. Keep that secret on your server. (2 minutes)

The same screen has a Try it now box: pick one of your bases and it gives you a link to open and an iframe to paste, so you can see an embedded view before you write a line of this.

Four lines. This is the only Artavolo-specific code you will write - or install the Node client that comes with your download (npm install ./deploy/packages/artavolo-embed) and call createEmbedToken(), which does the same thing with React and Vue components included.

$payload = json_encode([
  'v'    => 1,
  'mid'  => 42,                      // the Artavolo user from step 2
  'did'  => 7,                       // which base
  'tid'  => 0,                       // the sheet to open, or 0 for the whole base
  'mode' => 'write',                 // or 'read'
  'exp'  => time() + 600,            // valid for ten minutes
  'act'  => 'jane@yourcompany.com',  // your user, for the audit log
  'jti'  => bin2hex(random_bytes(8)),
]);

$b64   = fn($d) => rtrim(strtr(base64_encode($d), '+/', '-_'), '=');
$token = 'ARTE1.' . $b64($payload) . '.'
       . $b64(hash_hmac('sha256', $payload, $secret, true));

The same four lines in Node, Python or anything else - it is only base64url and HMAC-SHA256. Sign the exact bytes you send.

<iframe
  id="artavolo"
  src="https://data.yourcompany.com/base/BASE_CODE/embed?et=<?= $token ?>"
  style="width:100%;border:0"></iframe>

BASE_CODE is the code in the base’s own address bar. Load the page: your users are looking at their data, and never saw a login.

So the frame sizes itself and your own screen stays in step.

window.addEventListener('message', (event) => {
  if (event.origin !== 'https://data.yourcompany.com') return;
  const message = event.data;
  if (!message || message.source !== 'artavolo') return;

  if (message.type === 'height')
    frame.style.height = message.payload.height + 'px';

  if (message.type === 'rows.changed')
    refreshMyOwnView();
});