Skip to main content
The supported helper is website-sign-in.mjs. It exports createWebsiteSignIn(options) for a Node server. Start with the integration guide for a complete workflow.

​
Configuration

A verified session has user: { id, name?, avatarUrl? }, optional sessionId, and optional expiresAt. IDs are stable identifiers from your verified authentication system, not an email-based account match. Expiry is Unix milliseconds.

​
Returned methods

​
Sessions and expiry

Participation lasts at most 15 minutes before checking the source again, capped by a supplied source expiry. A valid website session can renew without another login prompt. If no session ID is available, the helper maintains a signed, HttpOnly bridge cookie. If expiry is omitted, the 15-minute lease still applies. The bridge cookie can last up to seven days; that does not extend participation authority. Do not reuse a revoked source session ID for a new login. A revoked session must remain revoked. Website identities never grant workspace permissions or become linked to Feedback Loop accounts because their email addresses match.

​
Server endpoints

All requests below are server-to-server POSTs to the primary Feedback Loop origin. Send Content-Type: application/json and Authorization: Bearer YOUR_SERVER_KEY. Use session: null for a guest check or completed logout. The purpose is check, login, or logout. Tickets expire after two minutes and are bound to the originating browser, project and destination. Follow the returned redirectUrl; never accept an arbitrary browser-supplied callback as authority. For logout, sourceHash binds the request to the matching source session. The Node helper handles this comparison.

​
Browser-managed authentication

If your existing SDK stores credentials in the browser:
  1. Host a page at the configured integration URL and read its opaque ticket.
  2. Obtain the provider credential through your existing SDK.
  3. Send it and the ticket to your own backend. The backend must verify that credential with your provider.
  4. On the server, use the project key to read the request purpose and complete it with the verified session or guest result.
  5. Navigate to the returned callback URL and implement logout/revocation with the same verified source binding.
The server key must never appear in that page, its bundle, browser storage or browser API calls. Do not treat a client-provided profile as verification.

​
Errors and recovery

The helper throws if its configuration is invalid or a server request fails. Check the exact saved HTTPS URL, active key, current Pro access and server-verified session. Never log bearer keys, tickets, cookies or raw provider credentials. An expired or already invalidated flow should restart from the community rather than reusing an old ticket.