> ## Documentation Index
> Fetch the complete documentation index at: https://docs.feedbackloop.page/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect website sign-in

> Let customers use their existing website accounts in your community.

You need **Pro**, control of your website's backend, an existing authentication system, and an HTTPS integration endpoint. This guide uses the maintained Node helper. It does not provide an authentication system for your website.

## 1. Create a server key

In **Settings → Community sign-in → Configure**, select **Website sign-in**, then **Generate server key**. Copy it immediately; the full secret is shown only once. Key creation takes effect immediately, independently of saving the policy.

Store it as `FEEDBACKLOOP_SSO_KEY` on your website's server. Generate a separate random bridge secret, for example:

```sh theme={null}
node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))"
```

Store that result as `FEEDBACKLOOP_BRIDGE_SECRET`. Keep both values out of browser bundles, client environment variables, repositories and logs.

## 2. Install the helper and connect your authentication

[Download website-sign-in.mjs](https://feedbackloop.page/integrations/website-sign-in.mjs) into your server application. It uses Node's built-in crypto and fetch APIs.

The `auth` methods below are illustrative adapters to your own provider. Replace them with your existing server-side session verification, sign-in response and logout operations.

```js theme={null}
import { createWebsiteSignIn } from './website-sign-in.mjs'
import { auth } from './your-existing-auth.mjs'

export const community = createWebsiteSignIn({
  apiKey: process.env.FEEDBACKLOOP_SSO_KEY,
  bridgeSecret: process.env.FEEDBACKLOOP_BRIDGE_SECRET,
  integrationUrl: 'https://example.com/feedbackloop-auth',
  adapter: {
    async getSession(request) {
      const session = await auth.verifySession(request)
      if (!session) return null
      return {
        user: {
          id: session.user.id,
          name: session.user.name,
          avatarUrl: session.user.avatarUrl,
        },
        sessionId: session.id,
        expiresAt: session.expiresAt,
      }
    },
    signIn(returnUrl) {
      return auth.signInResponse({ returnUrl })
    },
    async signOut(request) {
      await auth.signOut(request)
    },
  },
})

// Mount GET /feedbackloop-auth in your server framework.
export async function GET(request) {
  return community.handle(request)
}
```

`getSession` must verify the current session on the server. Use a stable user ID and a distinct session ID for each login, with expiry in Unix milliseconds. Profiles are display information, not proof of identity. If your provider has no session ID or usable expiry, see the [helper reference](/sign-in/reference#sessions-and-expiry).

## 3. Connect logout, account switching and deletion

For logout or account switching outside the community, revoke the browser session **before** ending the current website session. Append the returned cookie header to your normal response:

```js theme={null}
const expiredCookie = await community.revokeBrowserSession(request)
await auth.signOut(request)
const response = new Response(null, {
  status: 303,
  headers: { Location: '/sign-in' },
})
response.headers.append('Set-Cookie', expiredCookie)
return response
```

For a provider event with the verified session ID, call `await community.revokeSession(sessionId)`. After a website account is deleted, call `await community.deleteUser(userId)`. The latter revokes participation and starts removal of that user's contributions within this project.

## 4. Save the policy

Deploy the endpoint. Enter the exact same HTTPS integration URL in the sign-in dialog and choose **Save sign-in settings**. A saved configuration is not an end-to-end connection test.

## 5. Verify the visitor journey

1. Sign in to your website, then open the public community. Confirm the expected profile is used.
2. Submit a disposable request or vote, reload, and confirm access still works.
3. Sign out through the community and confirm the website session ends.
4. Sign in again, then log out or switch accounts from your website. Confirm the previous identity can no longer participate.
5. Verify your account-deletion hook in your own test environment.

Signing in returns the visitor to the originating community page; it does not replay a vote or submission. If the SDK keeps credentials in the browser, follow the [browser-managed authentication flow](/sign-in/reference#browser-managed-authentication) instead of putting a server key in the client.

For errors, check the [reference](/sign-in/reference) and [server key rotation guide](/sign-in/server-keys).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.