Widget: identified end users via a signed JWT

FeatureIn progressView on roadmap· by Elsama· 2 months ago

Split out of the Embeddable feedback widget card (whose MVP has shipped). Today the widget signs visitors in anonymously; this card lets a host site submit feedback as a known user.

Proposed shape:

A signing endpoint: the customer's backend calls Hollahoop with their API key plus the end user's id/email/name and gets back a short-lived JWT we sign.
The host passes that token to the widget via a data-user attribute or window.__hollahoop.identify(token).
/embed verifies the token (it is our own JWT), and submitPostAction associates the post with that identity instead of an anonymous user.
Anti-spoofing: verify signature + expiry server side; never trust client-supplied identity without a valid token.

Out of scope: full SSO, per-user notification routing.

Needs a decision on the JWT signing secret / key management before build.

Comments (0)

No comments yet.

Join the discussion