Connect website sign-in

You need Pro, control of your website’s backend, an existing authentication system, and an HTTPS integration endpoint. This guide uses the maintained Node helper. It does not provide an authentication system for your website.

1. Create a server key

In Settings → Community sign-in → Configure, select Website sign-in, then Generate server key. Copy it immediately; the full secret is shown only once. Key creation takes effect immediately, independently of saving the policy. Store it as FEEDBACKLOOP_SSO_KEY on your website’s server. Generate a separate random bridge secret, for example:

node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))"

Store that result as FEEDBACKLOOP_BRIDGE_SECRET. Keep both values out of browser bundles, client environment variables, repositories and logs.

2. Install the helper and connect your authentication

Download website-sign-in.mjs into your server application. It uses Node’s built-in crypto and fetch APIs. The auth methods below are illustrative adapters to your own provider. Replace them with your existing server-side session verification, sign-in response and logout operations.

import { createWebsiteSignIn } from './website-sign-in.mjs'
import { auth } from './your-existing-auth.mjs'

export const community = createWebsiteSignIn({
  apiKey: process.env.FEEDBACKLOOP_SSO_KEY,
  bridgeSecret: process.env.FEEDBACKLOOP_BRIDGE_SECRET,
  integrationUrl: 'https://example.com/feedbackloop-auth',
  adapter: {
    async getSession(request) {
      const session = await auth.verifySession(request)
      if (!session) return null
      return {
        user: {
          id: session.user.id,
          name: session.user.name,
          avatarUrl: session.user.avatarUrl,
        },
        sessionId: session.id,
        expiresAt: session.expiresAt,
      }
    },
    signIn(returnUrl) {
      return auth.signInResponse({ returnUrl })
    },
    async signOut(request) {
      await auth.signOut(request)
    },
  },
})

// Mount GET /feedbackloop-auth in your server framework.
export async function GET(request) {
  return community.handle(request)
}

getSession must verify the current session on the server. Use a stable user ID and a distinct session ID for each login, with expiry in Unix milliseconds. Profiles are display information, not proof of identity. If your provider has no session ID or usable expiry, see the helper reference.

3. Connect logout, account switching and deletion

For logout or account switching outside the community, revoke the browser session before ending the current website session. Append the returned cookie header to your normal response:

const expiredCookie = await community.revokeBrowserSession(request)
await auth.signOut(request)
const response = new Response(null, {
  status: 303,
  headers: { Location: '/sign-in' },
})
response.headers.append('Set-Cookie', expiredCookie)
return response

For a provider event with the verified session ID, call await community.revokeSession(sessionId). After a website account is deleted, call await community.deleteUser(userId). The latter revokes participation and starts removal of that user’s contributions within this project.

4. Save the policy

Deploy the endpoint. Enter the exact same HTTPS integration URL in the sign-in dialog and choose Save sign-in settings. A saved configuration is not an end-to-end connection test.

5. Verify the visitor journey

Sign in to your website, then open the public community. Confirm the expected profile is used.
Submit a disposable request or vote, reload, and confirm access still works.
Sign out through the community and confirm the website session ends.
Sign in again, then log out or switch accounts from your website. Confirm the previous identity can no longer participate.
Verify your account-deletion hook in your own test environment.

Signing in returns the visitor to the originating community page; it does not replay a vote or submission. If the SDK keeps credentials in the browser, follow the browser-managed authentication flow instead of putting a server key in the client. For errors, check the reference and server key rotation guide.

Start here

Community

Appearance

Domains

Website sign-in

Account and help

1. Create a server key

2. Install the helper and connect your authentication

3. Connect logout, account switching and deletion

4. Save the policy

5. Verify the visitor journey

​1. Create a server key

​2. Install the helper and connect your authentication

​3. Connect logout, account switching and deletion

​4. Save the policy

​5. Verify the visitor journey

1. Create a server key

2. Install the helper and connect your authentication

3. Connect logout, account switching and deletion

4. Save the policy

5. Verify the visitor journey