## TL;DR
Compare the secret the application signs with and the secret set on the Metabase instance, because signature verification fails when they differ by even a full regeneration. Regenerate the token with the current secret, confirm the payload uses the resource and parameters format Metabase expects, and check the expiry so the token is still valid when the page loads. The dashboard itself is usually healthy, only the signed request is rejected.

```text
Metabase dashboard embedding failed: JWT signature verification error fix
```

## Use this when
- Embedded dashboards show a signature verification message while the same dashboards open inside Metabase.
- The embedding secret was regenerated or the application was redeployed with new configuration recently.
- All embedded resources fail together, not just one dashboard.

## Not for this skill when
- Embedding is disabled on the instance entirely. Enable signed embedding before debugging signatures.
- One dashboard fails because it is not enabled for embedding. Enable that resource specifically.

## Steps
1. Open the Metabase admin embedding settings and note that signed embedding is enabled, without copying the secret into any ticket or log. Verify: embedding is on and a secret exists on the instance
2. In the application configuration, confirm the signing secret entry matches the instance value through your secure configuration channel. Verify: the application and the instance hold the same current secret value
3. Generate a fresh token with a short test expiry and the documented payload shape for the dashboard resource. Verify: the token decodes to the expected resource and parameters entries
4. Load the embedded page with the fresh token and confirm the dashboard renders. Verify: the iframe shows the dashboard instead of the signature message
5. Check the server clock on the application host against a reliable time source, since a skewed clock makes tokens look expired or not yet valid. Verify: the application clock is within seconds of the reference time
6. Rotate the secret deliberately on both sides if it may have been exposed during debugging, and redeploy the application configuration. Verify: embedded dashboards render with tokens signed under the rotated secret

## Why it happens
Signature failures are binary and total, which makes them look severe while the cause is a small configuration drift between two systems. The secret lives in two places by design, so any rotation process that updates only one side guarantees this outage. Treating the embedding secret like any other paired credential, rotated in one change on both sides, removes the failure mode.

Metabase signed embedding builds an iframe URL carrying a JSON Web Token signed with the instance embedding secret. The application server creates the token with the resource identifier, optional parameters and an expiry, and Metabase verifies the signature before rendering. Rotating the embedding secret on the instance, or deploying an application with an old copy of it, breaks every embedded dashboard at once while the Metabase interface keeps working normally.

Field notes for Metabase specifically. The admin troubleshooting area, the task history, and the application database query tools give the evidence for most incidents, and the audit views on paid plans show who changed a question or a dashboard and when. Metabase behaviour differs meaningfully between the open source and paid builds, and between the application database choices underneath, so note the exact version when filing or searching for an issue. A question that works in the editor but fails on a dashboard is almost always a dashboard layer setting, which is why the two surfaces should always be tested separately.

For Metabase teams, models are the control point worth investing in. Questions built directly on raw tables inherit every schema change at full force, while models give the team one place to absorb a rename or a type change before it reaches fifty saved questions. Keeping production dashboards on models, and raw table questions in a clearly marked sandbox collection, measurably reduces breakage after warehouse changes. It also gives the schema sync somewhere forgiving to land, since the model owner sees the change before viewers do.
## Variants and edge cases
### Metabase JWT signature verification failed embedding fix
The direct phrasing from the embedded error page.
### Metabase embedded dashboard secret mismatch after rotation
The rotation variant where one side kept the old secret.
### Metabase signed embedding token expired clock skew
The expiry variant where the token timing is at fault.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_9iQrsZA2-IDSZrPUkUmbNA