Automatic login

Automatic login lets UserJot recognize people who are already signed in to your product when they open your public UserJot surfaces.

It is separate from the widget itself. The widget can identify users on its own, but automatic login is what lets that identity carry over to your public board, roadmap, or changelog without asking the user to sign in again.

What automatic login does

After you identify the current user in the SDK, UserJot can attach a clientToken to allowed UserJot links from your product. When the user follows one of those links, UserJot reads that token and starts the public session as the identified user.

In practice, the flow looks like this:

Before you implement it

Enable the feature first in the dashboard:

Automatic login requires a paid plan. On the Free plan, the toggle is visible but disabled.

If you want the product-side explanation of those settings, use the support guide at /support/automatic-login.

Basic implementation

Load the SDK and initialize UserJot:

<script>window.$ujq=window.$ujq||[];window.uj=window.uj||new Proxy({},{get:(_,p)=>(...a)=>window.$ujq.push([p,...a])});document.head.appendChild(Object.assign(document.createElement('script'),{src:'https://cdn.userjot.com/sdk/v2/uj.js',type:'module',async:!0}));</script>
<script>
  window.uj.init('YOUR_PROJECT_ID');
</script>

Then identify the signed-in user from your product:

<script>
  window.uj.identify({
    id: 'USER_UNIQUE_ID',
    email: 'user@example.com',
    firstName: 'John',
    lastName: 'Doe',
    avatar: 'https://example.com/avatar.jpg'
  });
</script>

The id field is required. email is strongly recommended because it helps UserJot keep the public identity more useful and easier to reconcile.

Secure mode: signed tokens

If Require signed tokens is enabled, include a server-generated signature in the identify() payload.

<script>
  window.uj.identify({
    id: 'USER_UNIQUE_ID',
    email: 'user@example.com',
    firstName: 'John',
    lastName: 'Doe',
    avatar: 'https://example.com/avatar.jpg',
    signature: 'SERVER_GENERATED_SIGNATURE'
  });
</script>

The signature must be generated on your server. Do not generate it in the browser or expose your workspace secret to the client.

The current secure mode verifies an HMAC SHA-256 signature of the user ID using your workspace secret. Copy the secret from the Secrets section on Settings → Login, where it is listed as Project secret.

Server-side signing examples

import crypto from 'node:crypto';
 
export function signUserJotIdentity(userId, secret) {
  return crypto.createHmac('sha256', secret).update(userId).digest('hex');
}

Use the returned value as signature in window.uj.identify(...).

What happens after identify()

Once the SDK knows who the user is, UserJot can add authentication data to supported UserJot links from your product.

For example, links like these can carry the identified session through:

<a href="https://feedback.example.com/">Give feedback</a>
<a href="https://feedback.example.com/roadmap">Roadmap</a>
<a href="https://feedback.example.com/updates">Updates</a>

You do not need to manually build the clientToken yourself. The SDK handles that after identification, as long as the target URL points to an allowed UserJot domain for the current project.

Important limitations

Common implementation pattern

In most apps, you should call identify() after the user session is ready and call identify(null) when the user logs out.

if (user) {
  window.uj.identify({
    id: user.id,
    email: user.email,
    firstName: user.firstName,
    lastName: user.lastName,
    signature: user.userJotSignature
  });
} else {
  window.uj.identify(null);
}

Troubleshooting

The user still sees a login prompt

Check these first:

Secure mode is enabled, but automatic login still fails

Check these: