Skip to main content

​
Overview

The Embed block puts another site’s page onto a Custral page. Paste an https:// address and it renders in place: a Grafana panel, a Metabase question, a Looker Studio report, a Loom recording, a Figma board. The page is sandboxed. It runs in its own origin, it cannot read your workspace, and it is handed nothing about you: no session, no token, no record.
An Embed block you configure yourself has no access to Custral data at all. A provider’s embed block, installed from an integration, can ask for read access, and when it does you are shown exactly what it is asking for before it installs.

​
Configuration parameters

Most services have a page URL you can read and a different one you can embed. Paste whichever you have. The address from your browser’s bar is fine. Anything else is used exactly as you pasted it, query string and fragment included. That matters more than it sounds: a Grafana panel’s ?from / ?to / ?panelId and a Metabase question’s # fragment are what is being embedded, so they are never rewritten or dropped.

​
Tested URL shapes

Turn allowFullscreen on for video and design tools, where a reader will want the whole screen. Leave it off for dashboards. A panel has nothing to expand into, and the capability is not granted unless it is asked for.

​
What will not embed, and why

A blank frame is almost always the third-party site declining to be embedded. Custral cannot detect that from outside the frame (the browser reports a refused frame and a successfully-loaded one identically), so the block cannot tell you which it was.

​
Privacy

  • The framed page is told nothing about the Custral page it sits on. The referrer is stripped, so the service is not sent your workspace’s address.
  • It cannot navigate your tab away from Custral.
  • It cannot read or write your workspace unless it is a provider’s embed block you explicitly consented to at install.