Clear the server gate
Get your extension running on Tableau Cloud or Server — know the three admin switches that decide its fate, and send the admin exactly what they need.
Why it matters
Desktop trusts you; the server trusts nobody. On Tableau Cloud and Tableau Server, extensions are governed per site, and a network-enabled extension — anything hosted on your own URL, which is everything this wall builds — runs only if an admin has put its exact URL on the site's safelist. This is where extensions die in real organizations: not in code, but in a request the admin didn't understand and parked. The fix is speaking their language — what the switch is called, where it lives, what your extension can and cannot see — so approval is a two-minute yes instead of a security review that never ends.
Draft the message I send our Tableau Cloud site admin to approve my dashboard extension. It must: name the exact URL to add to the safelist under Settings → Extensions (https://vizyourdata.github.io/hello-dashboard/index.html); state that it is a network-enabled extension, so the default sandboxed-only policy does not cover it; say whether to check 'Allow full data access' (mine reads only summary data, so no) and what checking it would additionally expose; ask them to confirm 'Let users run extensions on this site' is on; and give a one-sentence description of what the extension does and which workbooks will use it. Keep it under 150 words and free of jargon the admin would have to look up.
Everything an admin controls lives on one page — Settings → Extensions on the site — and reduces to three decisions:
| Switch | Default | What it decides |
|---|---|---|
| Let users run extensions on this site | On | The master switch. Off means no extension of any kind, anywhere on the site. |
| Enable sandboxed extensions by default | On | Covers only Tableau-hosted, no-outside-network extensions. Yours is not one — self-hosted means network-enabled. |
| The safelist | Empty | Network-enabled extensions run only from URLs listed here — exact page URL, not just the domain — each with its own Allow full data access and show user prompts choices. |
So the ask is almost always the same: add one exact URL to the safelist, and check full data only if the extension truly reads underlying rows. Everything the reading route built needs no full data at all — say so, because it is the difference between an easy yes and a data-governance meeting.
Got what you came for? Mark the stop and the line fills in beneath you.