# Enable public dashboard inputs and actions

> Source: https://docs.clonepartner.com/guides/public-dashboard-widget-execution/

A public dashboard share can be read-only, allow controlled configuration inputs, or expose explicitly approved actions. Treat each level as a separate capability and enable only what the workflow requires.

Public shares use a token in the URL. They do not create an authenticated Envoy user.

## Three independent controls

### Viewing

`ENVOY_PUBLIC_DASHBOARDS_ENABLED` controls public share viewing. It defaults on unless set to `0` or `false`.

Disable it globally when public dashboards are not used:

```text
ENVOY_PUBLIC_DASHBOARDS_ENABLED=false
```

### Input widgets

Public editing of `form` and `field_mapping` widgets requires both:

```text
ENVOY_PUBLIC_DASHBOARD_INPUT_ENABLED=true
```

and:

```yaml
dashboard:
  allow_public_input: true
```

The server switch defaults off.

### Action widgets

Public action execution requires:

```text
ENVOY_PUBLIC_DASHBOARD_ACTIONS_ENABLED=true
```

and `allow_public: true` on the individual action widget. The widget must be on a public page. The action switch defaults off.

Keep all three controls off in environments where they are unnecessary.

## Add a controlled form action

```yaml
dashboard:
  allow_public_input: false
  pages:
    - id: request
      title: Request access
      widgets:
        - id: send_invite
          type: action
          label: Send invite
          description: Send an invitation to an approved domain.
          allow_public: true
          cooldown_seconds: 30
          confirm_message: Send this invitation now?
          form:
            fields:
              - key: email
                label: Work email
                type: text
                format: email
                required: true
          action:
            kind: run_task
            task: invite_user
            arguments_expr: |
              {
                "email": form.email
              }
```

An action form supplies one execution request; it does not require public `job_config` editing. Every action opens a confirmation dialog.

## Choose an action kind

- `run_task` starts one task with the job's connector mapping and authored arguments.
- `job_run` starts the job or selected task keys with the job's existing arguments and `job_config`.
- `connector_method` invokes one explicitly authored mapped-connector method.

`job_run` does not accept client-supplied argument expressions. Use stored job configuration for its inputs.

Never let a public user provide:

- connector name or ID;
- method name;
- endpoint or path;
- arbitrary JSONata;
- raw query;
- tenant or account identity outside a constrained static choice;
- credentials or tokens.

## Scope and validate input

For public actions:

- define required fields and formats;
- prefer fixed static options;
- constrain text length and numeric range;
- derive tenant or job identity server-side;
- validate again in the task or connector operation;
- use stable idempotency keys for writes.

The public path ignores client-supplied row context. Dynamic option sources do not turn arbitrary submitted values into trusted values; public actions enforce authored choices.

## Concurrency and audit behavior

Envoy prevents duplicate in-flight execution for the same widget and applies `cooldown_seconds` after an attempt. Every action creates an audit row and links to the task or job run when applicable.

A cooldown reduces accidental repetition; it is not business-level idempotency. The destination write must still reconcile duplicate or ambiguous requests.

## Share safely

1. Keep the page read-only first.
2. Verify all data queries have fixed scope.
3. Add one input or action at a time.
4. Enable the server switch in a test environment.
5. test valid, invalid, repeated, and concurrent submissions;
6. confirm action audit rows and underlying runs;
7. inspect the share in a private browser session;
8. enable production only after operational review.

Treat a share URL as a bearer credential. Send it only through an approved channel, revoke it when the audience changes, and do not expose privileged diagnostic pages.

See [Author an operational dashboard](/guides/dashboard-authoring) and [Dashboard schema and widgets](/reference/dashboards).