Skip to main content

​
1. Overview

This document walks you through the one-time setup required on your Tableau site so Pavo AI can securely ingest data from your published Tableau data sources. Pavoai connects to your Tableau site via Tableau’s REST API and VizQL Data Service (VDS) to read metadata and row-level data from published data sources you authorize. There are two supported authentication methods. Choose one based on your environment: Connected App is the PAVO recommended Approach.

​
2. Prerequisites

Regardless of method, confirm the following before starting:
  • You have Site Administrator role on the Tableau site you want Pavoai to connect to.
  • You know your site’s pod URL (e.g. https://10ax.online.tableau.com) and site content URL (the value after /site/ in your site URL — for the default site on Tableau Server, this is empty).
  • You have identified the data source(s) you want Pavoai to access. These must be published data sources (data sources embedded inside workbooks are not supported).
  • Your Tableau site is on a version that supports VizQL Data Service:
    • Tableau Cloud: supported (generally available).
    • Tableau Server: version 2025.1 or later required.

​
3. Create a service user and grant data source access

These steps apply to both authentication methods. Complete this section before proceeding to Option A or Option B.

​
3.1 Create a dedicated service user

Pavoai should authenticate as a dedicated service account rather than an individual employee. This prevents access breaking if the employee leaves or changes roles.
  1. Users (left navigation) → Add Users → Add Users by Email.
  2. Create a user with an email like tableau-pavoai@yourcompany.com (use a shared mailbox or group alias).
  3. Assign the site role Explorer (can publish) or higher.
  4. Grant this user access (direct or via group) to the projects and data sources Pavoai should be able to read.
  5. Sign in as this user once to activate the account.

​
3.2 Grant API Access to the data sources

This step is commonly missed and will cause 403 errors if skipped. For each published data source Pavoai should access:
  1. Navigate to the data source in Tableau.
  2. Click Actions → Permissions.
  3. Add the service user (or the group containing it).
  4. Ensure the API Access capability is set to Allowed.
  5. Click Save.

​
4.1 Create the Connected App

  1. Sign in as a Site Administrator.
  2. Settings (left navigation) → Connected Apps tab.
  3. Click the New Connected App dropdown → Direct Trust.
  4. In the dialog:
    • Connected app name: Pavoai
    • Access level / Applies to: select either All projects or the specific projects Pavoai should access (recommended: limit to a dedicated project).
    • Domain allowlist: leave as All domains (this setting applies only to embedded content, not REST/VDS API calls).
  5. Click Create.

​
4.2 Generate the secret

  1. Click into the newly created Pavoai connected app.
  2. Click Generate New Secret.
  3. You will see:
    • Secret ID — a UUID (always visible).
    • Secret Value — click the eye icon to reveal. Copy this value immediately to a password manager. The value is displayed once and cannot be retrieved afterward.
  4. Also copy the Client ID shown further down the page.

​
4.3 Enable the Connected App

Connected Apps are created in a disabled state.
  1. On the Connected App detail page, click the ⋯ (three-dots menu) next to the app name.
  2. Select Enable.
  3. Confirm the Status field now reads Enabled.

​
4.4 Identify the user(s) Pavoai will impersonate

Unlike a PAT, a Connected App does not log in as the app — each JWT specifies which Tableau user to act as (the sub claim). Pavoai will impersonate this user, and will inherit all of that user’s permissions including row-level security. Recommended: use the dedicated service user created in Section 3.1. Ensure that user has been granted API Access on the relevant data sources per Section 3.2. If your use case requires Pavoai to act as multiple users (e.g. for per-user RLS enforcement), please coordinate with the Pavoai team — we will guide you on the user-mapping configuration.

​
4.5 Values to send to Pavoai

Send the following values via the secure channel described in Section 6: Skip To section 6

​
5.1 Enable PAT creation on the site

On Tableau Cloud sites activated after June 2023, PAT creation is disabled by default. Enable it first:
  1. Sign in to your Tableau site as a Site Administrator.
  2. In the left navigation, click Settings.
  3. On the General tab, scroll to the Personal Access Tokens section.
  4. Check Enable personal access tokens.
  5. Under Applies to, select either All users or a specific group (a dedicated group for service accounts is recommended).
  6. Under Set expiration period, select 180 days (or your organization’s standard).
  7. Click Save at the bottom of the page.

​
5.2 Create the PAT

Signed in as the service user created in Section 3.1 (not the admin user):
  1. Click the profile icon (top right) → My Account Settings.
  2. Scroll to the Personal Access Tokens section.
  3. Enter a token name (e.g. pavoai-prod).
  4. Click Create Token.
  5. Copy the Token Secret immediately. It is displayed only once. If lost, you must create a new token.
  6. Click Done.

​
5.3 Values to send to Pavoai

Send the following six values via the secure channel described in Section 6:

​
6. How to send credentials to Pavoai

Do not send the Token Secret or Connected App Secret Value by email or unencrypted chat. Use one of the following:
  • 1Password / LastPass / Bitwarden shared vault (preferred). Pavoai can provide an item to share into.
  • Directly onboard the connector yourself if you have access to pavo’s instance.
The non-secret values (server URL, site content URL, client ID, secret ID, user email) can be sent in plain channels.

​
7. Verification

Once Pavoai has received your credentials, we will run a connectivity test that:
  1. Authenticates against your Tableau site.
  2. Lists the projects and data sources visible to the configured user.
  3. Fetches metadata (field names and types) from one data source you nominate.
  4. Reads a small sample (≤100 rows) from that data source.
We will share the results with you for sign-off before enabling any production ingestion.
Pavo is read only by design. Pavoai requests only read scopes (tableau:content:read, tableau:viz_data_source:read) in every JWT. No write, delete, or admin scopes are ever requested. You can verify this in your Tableau audit log, and you can further enforce it by assigning the service user (Section 3.1) a Viewer or Explorer site role — neither of which permits modification of published data sources.