Sign users into Feedjolt without a login screen.
Your app signs a JWT with a shared secret and Feedjolt identifies the user instantly. No second login, no extra password — totally transparent to them.
Two logins is one too many.
Your users already signed into your app. Making them log into Feedjolt again — new screen, second password — is friction that kills feedback before it starts. Worse, anonymous sessions leave you guessing who actually said what.
Everything JWT single sign-on should do.
Your app signs a JWT with your shared secret; Feedjolt verifies the signature and identifies the user on the spot. No extra login, no second password.
One token works everywhere Feedjolt shows up: the public portal and the in-app widget. Sign in once and you're known in both.
Sign with HS256, or step up to HS384 or HS512. A shared secret only your server and Feedjolt know.
Rotate your signing secret without breaking a thing. Old keys keep working through the rollover, so tokens in flight never bounce.
After verifying your token, Feedjolt issues a short-lived, server-side session cookie. The browser is never handed your identity to forge.
Because every user is identified, you always know who submitted feedback and who voted — no anonymous guesswork.
From token to session, without them noticing.
Your backend mints a JWT with the user's id, email, and name, signed with your Feedjolt secret.
Pass the token to the portal or drop it on the widget's data-sso-token attribute. Feedjolt verifies the signature and the expiry.
Feedjolt matches or creates the user, sets a server-side session cookie, and they're signed in — no screen, no password.
Secure and seamless, with no effort.
Identity is verified by signature and never trusted from the browser. Sessions are short-lived and issued server-side.
No second login, no extra password, no redirect dance. They're already them, so they're already in.
Roll your secret on your own schedule. The rollover window keeps old tokens valid so nothing breaks mid-flight.
Identified users mean clean attribution: who submitted, who voted, and who you can follow up with.
Frequently asked, plainly answered.
What is JWT SSO?
JWT SSO lets your app log users into Feedjolt with a signed token instead of a separate login. Your backend signs a JWT with a shared secret; Feedjolt verifies it and identifies the user instantly — no second password, no extra screen.
Does it work for the widget and the portal?
Yes. The same signed token works for the public portal and the in-app widget. Drop it on the widget's data-sso-token attribute or pass it to the portal, and the user is identified in both.
Which signing algorithms are supported?
Feedjolt verifies HMAC-signed tokens: HS256, HS384, and HS512. You sign with a shared secret that only your server and Feedjolt know.
How do I rotate my signing secret?
Set a new secret whenever you like. Feedjolt keeps your recent previous keys valid during the rollover, so tokens already signed with the old secret keep working until they expire — no downtime, no broken sessions.
Is it safe to identify users this way?
Yes. The browser is never trusted with identity — after verifying your token Feedjolt issues a short-lived, server-side session cookie scoped to that user. Tokens carry an expiry, so stale ones are rejected.
Do I still know who submitted and voted?
Always. Because every session is tied to an identified user, you can see exactly who submitted each piece of feedback and who voted — clean attribution, no anonymous gaps.