Embed external web pages, apps or videos inside an Astrato workbook.
When to use:
Dynamically show videos, docs, or vendor apps next to charts.
Host interactive tools that live outside Astrato.
Add it:
In the editor, select Graphics › Iframe.
Enter the URL.
Resize using the corner handles.
Security allowlist (required):
Admins must allow the domain:
Go to Admin › Security › Content Security Policy (CSP).
Add domains under Allowed iframe domains. Example:
https://www.youtube.comhttps://player.vimeo.comhttps://your.subdomain.com
Use HTTPS only.
Sites that may not embed
If a site sets X-Frame-Options: DENY/SAMEORIGIN or Content-Security-Policy: frame-ancestors ... that excludes your domain, it will not load inside Astrato. Ask the site owner to permit your Astrato domain.
Settings
URL: Full address to load. Query strings supported.
Maximize: Use the container setting for "maximize object". Operational in preview/published mode only.
Behavior and limits
No cross-filtering with Astrato charts.
Performance depends on the external site.
Astrato does not pass your workbook session to third parties.
Scrolling is controlled by the embedded page.
YouTube example:
Use the embed URL format:
https://www.youtube.com/embed/7jKfP8MZ8I8?si=_V--T08DaoSx1BZQ
Steps:
Allow
https://*.youtube.comin CSP.Set the iframe URL to the line above with your
VIDEO_ID.Resize the object container to 16:9 for best results.
Internal app example:
Allow https://apps.yourcompany.com in CSP.
Troubleshooting:
Blank frame: Not on allowlist, mixed content (HTTP), or blocked by
X-Frame-Options/frame-ancestors.Endless login: Third‑party cookies blocked or SSO requires top‑level navigation; open in new tab.
Only some pages work: Path-level CSP on provider side; ask them to permit your page.
Slow loads: Heavy third‑party scripts on the embedded site; optimize or use a lighter page.
ℹ️Localhost is not supported - Astrato runs in the cloud.
FAQ:
Can I control the iframe content from Astrato? No.
Can the iframe read Astrato data? No.
Can I theme the iframe? Only via CSS provided by the external site.
Does it work in exports? Static image/PDF may capture a snapshot if the site allows; dynamic interactivity is not exported.