Can I make a Superset dashboard public?

Superset has a Public role you can grant dashboard access to, which makes those dashboards readable by unauthenticated visitors of your Superset instance. It is coarse — it is a role on the instance, not a per-link token — so most teams that try it end up reverting it. There is no per-dashboard shareable public URL of the kind Metabase offers.

Why does my Superset permalink ask people to log in?

Because a permalink encodes dashboard state, not authorization. It stabilizes the filters and time range you had applied so the recipient lands on the same view — but they still need an account with access to the dashboard and its datasets.

How do I email a Superset dashboard on a schedule?

Alerts & Reports handles it, and it needs infrastructure: a Celery worker, a beat scheduler, a Redis or RabbitMQ broker, and a headless browser for the screenshot. Once configured it emails a PNG or sends it to Slack on a cron. The output is an image, so it is a record rather than something anyone can query or discuss inline.

How do I share Superset results with someone who has no account?

Query the same datasets through the Superset API or directly against the warehouse, render the numbers into one self-contained HTML page, and publish that page to a stable URL with an anchored comment layer. No seat, no Public role, and the discussion stays attached to the figures.

How do I keep the same URL every week?

Publish once, keep the report id, and PATCH it each run. Revisions stack at the same URL, so a pinned link stays correct and two runs can be diffed.

How to share an Apache Superset dashboard

Superset's sharing story is the most self-hosted-shaped of any BI tool: every mechanism assumes the reader can reach your Superset instance and has a role in it. That assumption holds for the analytics team and breaks for everyone else.

What Superset gives you

A permalink. The share menu produces a URL that encodes the current dashboard state — applied filters, time range, tab. It is a genuinely useful feature and it is about state, not access. The recipient still logs in.

The Public role. You can grant the built-in Public role read access to specific dashboards, which lets unauthenticated visitors of your instance open them. It works, and it is a blunt instrument: it is a role on the deployment, enabled globally in config, not a revocable per-link token. Teams typically try it once for one dashboard, realize the blast radius, and roll it back.

Alerts & Reports. Scheduled screenshots emailed or Slacked on a cron. Real and dependable, and it wants a Celery worker, a beat process, a Redis or RabbitMQ broker, and a headless browser in the image. If your deployment already has that stack, this is the least-effort scheduled option. What you get out of it is a PNG: a record, not a document, and nothing anybody can quote a cell from.

CSV export per chart. Fine for one number. Not a way to send a dashboard.

The pattern that works for outside readers

Rebuild the dashboard's numbers as one self-contained HTML page and publish it to a stable URL with a comment layer on top.

The rebuilding is less work than it sounds, because Superset charts are thin wrappers around a dataset query. You have two clean routes:

Through Superset. POST /api/v1/chart/data runs a chart's query and returns JSON, so a script that walks the chart ids on a dashboard gets every number the dashboard shows.

Around Superset. The dashboard's underlying SQL runs against the same warehouse. If the numbers are the point and the Superset styling is not, query the warehouse directly and skip a dependency.

Either way, write plain HTML — inline styles, real <table> markup, no runtime fetches — and publish:

python3 scripts/superset_digest.py > digest.html

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html digest.html \
        --arg title "Marketplace metrics — $(date +%F)" '{title: $title, html: $html}')"

Real text beats a screenshot for the same reason it does everywhere else: it is searchable, quotable, copy-pasteable into a spreadsheet, and readable by an answer engine. A PNG of a table is a table nobody can use.

What the comment layer changes

The published page carries anchored threads. Somebody highlights the GMV row and writes "this excludes the returns adjustment, see the note in dbt." That thread persists across revisions, so the caveat is attached to the number rather than living in one analyst's head.

Readers need no Superset account and no Public role, because access is a property of the report: private, team, domain-gated or link.

Keep the cron somewhere sensible

If you already run Airflow next to Superset, put the digest job there. If you would rather not own a scheduler for one report, a routine runs it on Comma's side and PATCHes the same report id, which gets you the stable URL and the revision history without the infrastructure.

When to just use Superset

If everyone reading has an account and the value is in pivoting — changing the filter, drilling into the cohort, exporting a slice — send the permalink. Interactive beats static whenever the reader can actually get in. The digest is for the audiences that cannot, and for the weeks you want a durable, dated, commentable record of what the numbers were.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Create your first report →