Auto-Login
Auto-login silently signs a user into the FeedbackJar portal when they’re already logged into your app. Your backend signs a short-lived HMAC token for the current user, your frontend passes it to the widget, and the portal verifies it and logs the user in — no separate login screen, no redirect round-trip to your servers.
This is for carrying an already-identified widget user into the portal (e.g. a “View all feedback” link inside your logged-in app). It’s separate from Single Sign-On, which handles someone landing on your public board directly and clicking “Log in” there.
Enable auto-login
- Open Settings → Auto-login in your project dashboard.
- Toggle Enable auto-login on.
- Copy your secret key.
How it works
- After a user logs into your app, your backend computes an HMAC-SHA256 signature over
userId:email:timestamp, keyed with your project’s secret key. - Your frontend calls
window.fj.identify(...)with the user’s info plus thatsignatureandtimestamp, thenwindow.fj.navigateToPortal(). - The SDK builds a
fj_authURL parameter (base64url-encoded) and opens the portal with it attached. - The portal reads
fj_auth, sends it to FeedbackJar’s server for verification, and — if valid — logs the user in and issues a session.
Signatures expire 15 minutes after the timestamp they were signed with. Generate the timestamp right before signing and use it immediately; don’t cache a signature for later use.
Signing the token
const crypto = require('crypto');
const secretKey = 'YOUR_SECRET_KEY';
const userId = 'user_123';
const email = 'user@example.com';
const timestamp = Date.now(); // generate now, send all three to the client
const signature = crypto
.createHmac('sha256', secretKey)
.update(`${userId}:${email}:${timestamp}`)
.digest('hex');
// Return signature + timestamp + the SAME email — the client must send back
// these exact values, not generate/substitute its own. The signature expires
// 15 minutes after this timestamp.Node.js, Python, PHP, Ruby, and C# examples (pre-filled with your project’s real secret key) are available in Settings → Auto-login in your dashboard.
Identifying the user (web)
<script src="https://cdn.feedbackjar.com/sdk.js"></script>
<script>
window.fj.init('YOUR_WIDGET_ID');
</script>// After user logs in, fetch { signature, timestamp } from your backend
// (using the code above), then pass BOTH through unchanged — timestamp
// must be the exact value your server hashed, not a fresh client-side one:
window.fj.identify({
id: 'user_123',
email: 'user@example.com',
firstName: 'John',
lastName: 'Doe',
avatar: 'https://example.com/avatar.jpg',
organizationId: 'YOUR_ORGANIZATION_ID',
signature: 'GENERATED_ON_SERVER_SIDE',
timestamp: 1234567890123 // GENERATED_ON_SERVER_SIDE — same value used to sign
});
// Open the feedback portal with auto-login
window.fj.navigateToPortal();
// Or with a custom domain:
window.fj.navigateToPortal('feedback.yourdomain.com');Identifying the user (iOS / Android)
On mobile, build the same payload, base64url-encode it, and append it as the fj_auth query parameter when opening the portal URL in the browser. See the iOS (Swift) and Android (Kotlin) code samples in Settings → Auto-login in your dashboard — they follow the exact same payload shape as the web SDK.
Payload reference
| Field | Required | Description |
|---|---|---|
id | Yes | Stable user ID from your system |
email | Yes | User’s email address — part of the signed message |
timestamp | Yes | Unix ms timestamp used when signing — signed message, expires after 15 min |
signature | Yes | HMAC-SHA256 of userId:email:timestamp, hex-encoded |
organizationId | Yes | Your FeedbackJar project ID |
firstName | No | Given profile field |
lastName | No | Family profile field |
avatar | No | Avatar URL |
Security notes
- Never expose your secret key to client-side code — generate signatures on your server only.
emailis part of the signed message, so a valid signature cryptographically proves your backend vouches for that exact(userId, email)pair — an attacker can’t swap the email field without invalidating the signature.- Auto-login is disabled for admin/owner accounts — it’s for your end-users, not your FeedbackJar project team.
- Regenerate your secret key if it’s ever exposed. Rotating it immediately invalidates every signature generated with the old key.
Troubleshooting
Auto-login validation returns one of these errors if it fails:
| Error | Cause |
|---|---|
Organization not found | The organizationId you sent doesn’t match any project |
Auto-login is not enabled for this organization | Toggle it on in Settings → Auto-login |
Secret key not configured | No secret key exists yet — open Settings → Auto-login to generate one |
Token expired or invalid | More than 15 minutes passed between signing and use, or the timestamp is in the future |
Invalid signature | The signature doesn’t match — check you’re signing userId:email:timestamp with the current secret key |
Auto-login is not available for admin accounts | The email belongs to a project owner/admin — auto-login is for end-users only |
Auto-login vs. Single Sign-On
| Auto-login | Single Sign-On | |
|---|---|---|
| Who starts it | Your app, via the widget SDK | The user, by clicking “Log in” on your public board |
| Best for | A logged-in user clicking through from inside your app | A visitor landing directly on your board |
| Format | HMAC-SHA256 signature in a URL parameter | JWT (HS256) via a server-to-server redirect |
| Network flow | One-way: your frontend → portal | Round-trip: portal → your SSO endpoint → FeedbackJar → portal |
| Requires a public redirect endpoint on your server | No | Yes |