> ## Documentation Index
> Fetch the complete documentation index at: https://docs.feedbackloop.page/llms.txt
> Use this file to discover all available pages before exploring further.

# Website sign-in reference

> Understand the Node helper, verified sessions and server API.

The supported helper is [website-sign-in.mjs](https://feedbackloop.page/integrations/website-sign-in.mjs). It exports `createWebsiteSignIn(options)` for a Node server. Start with the [integration guide](/sign-in/website) for a complete workflow.

## Configuration

| Option | Contract |
| - | - |
| `apiKey` | Secret key for this project's website sign-in integration |
| `bridgeSecret` | Private signing material; generate at least 32 random bytes and encode for environment storage |
| `integrationUrl` | Your fixed HTTPS endpoint, matching the saved project policy |
| `feedbackLoopUrl` | Optional fixed Feedback Loop origin; defaults to `https://feedbackloop.page` |
| `adapter.getSession(request)` | Returns a verified session or `null` for a guest |
| `adapter.signIn(returnUrl)` | Returns your website's login response and returns the visitor to the supplied integration URL after login |
| `adapter.signOut(request)` | Ends the current verified website session |

A verified session has `user: { id, name?, avatarUrl? }`, optional `sessionId`, and optional `expiresAt`. IDs are stable identifiers from your verified authentication system, not an email-based account match. Expiry is Unix milliseconds.

## Returned methods

| Method | Purpose |
| - | - |
| `handle(request)` | Handles the integration GET request and returns a standard `Response` |
| `revokeBrowserSession(request)` | Revokes the verified browser source and returns an expired bridge-cookie header; call before website logout/switching |
| `revokeSession(sessionId)` | Revokes participation derived from a known source session |
| `deleteUser(userId)` | Revokes this project's website identity and starts scoped contribution cleanup |

## Sessions and expiry

Participation lasts at most 15 minutes before checking the source again, capped by a supplied source expiry. A valid website session can renew without another login prompt. If no session ID is available, the helper maintains a signed, HttpOnly bridge cookie. If expiry is omitted, the 15-minute lease still applies. The bridge cookie can last up to seven days; that does not extend participation authority.

Do not reuse a revoked source session ID for a new login. A revoked session must remain revoked. Website identities never grant workspace permissions or become linked to Feedback Loop accounts because their email addresses match.

## Server endpoints

All requests below are server-to-server POSTs to the primary Feedback Loop origin. Send `Content-Type: application/json` and `Authorization: Bearer YOUR_SERVER_KEY`.

| Endpoint | JSON body | Result |
| - | - | - |
| `/api/sso/v2/request` | `{ "ticket": "…" }` | Project, purpose, expiry and logout source binding |
| `/api/sso/v2/complete` | `{ "ticket": "…", "session": { … } }` | Exact `redirectUrl` for the originating community |
| `/api/sso/v2/revoke` | `{ "sessionId": "…" }` | Revocation completion |
| `/api/sso/v2/delete-user` | `{ "userId": "…" }` | Scoped cleanup acceptance |

Use `session: null` for a guest check or completed logout. The `purpose` is `check`, `login`, or `logout`. Tickets expire after two minutes and are bound to the originating browser, project and destination. Follow the returned `redirectUrl`; never accept an arbitrary browser-supplied callback as authority. For logout, `sourceHash` binds the request to the matching source session. The Node helper handles this comparison.

## Browser-managed authentication

If your existing SDK stores credentials in the browser:

1. Host a page at the configured integration URL and read its opaque `ticket`.
2. Obtain the provider credential through your existing SDK.
3. Send it and the ticket to your own backend. The backend must verify that credential with your provider.
4. On the server, use the project key to read the request purpose and complete it with the verified session or guest result.
5. Navigate to the returned callback URL and implement logout/revocation with the same verified source binding.

The server key must never appear in that page, its bundle, browser storage or browser API calls. Do not treat a client-provided profile as verification.

## Errors and recovery

The helper throws if its configuration is invalid or a server request fails. Check the exact saved HTTPS URL, active key, current Pro access and server-verified session. Never log bearer keys, tickets, cookies or raw provider credentials. An expired or already invalidated flow should restart from the community rather than reusing an old ticket.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.