Identify signed-in users in the widget

By default the widget treats visitors as guests. Identifying a signed-in user attaches their name and avatar to every post, comment, and vote they make.

How identification works

You generate a signed identity object on your server after the user logs in, then pass it to the widget in the browser. The signature is created with your Widget secret, which must never appear in browser code or public environment variables.

Finding your signing secret

Go to Settings → Workspace → Embed widget. Featul provisions the signing secret automatically when your workspace is created.

The server-side step

On your server, after login:

1. Take the user's id, email, name, and image.

2. Build the payload and sign it with HMAC-SHA256 using your Widget secret.

3. Include an expiresAt timestamp set five minutes from now.

4. Return the signed identity object from an authenticated API endpoint.

The browser-side step

1. Fetch the signed identity from your authenticated endpoint.

2. Call featul.identify(identity) with the returned object.

3. When the user logs out, call featul.identify(null) to clear the identity.

What happens with invalid identities

Unsigned, expired, or modified identities are treated as guests. Generate a fresh identity after login and before the five-minute signature window closes.