Automatic login

Automatic login lets UserJot recognize people who are already signed in to your product. Instead of asking those users to log in again when they open your feedback board, roadmap, or changelog, UserJot carries their identity through automatically.

It is separate from the widget itself. The widget can identify users on its own; automatic login is what lets that identity carry over to your public pages, and to embedded pages, without a second sign-in.

Enable automatic login

1. Open Settings in your workspace, then go to Login.

2. Under Authentication, turn on Automatic login.

3. For the stricter setup, also turn on Require signed tokens. The option appears once automatic login is on.

Automatic login is available on paid plans. On the Free plan, the toggle is visible but disabled until you upgrade.

What the signed token setting does

A plain identify call comes from the browser, so it can be tampered with. With Require signed tokens on, UserJot only accepts identities that your server has signed as a JWT, and unsigned identify calls are rejected. For most teams this is the more secure setup. Signed identity covers creating the token.

How it works

1. Enable automatic login in the dashboard.

2. Install the widget in your product.

3. Call uj.identify(...) for the signed-in user, with a signed token if you require them.

4. Link to your board, roadmap, or updates page from your product.

After identify, the SDK attaches the identity to links from your product that point to your public UserJot pages, as long as the link points to a UserJot domain for the current project: your userjot.com address or your custom domain. When the user follows one of those links, UserJot starts the public session as that user. You never build the token into the link yourself.

<a href="https://feedback.example.com/">Give feedback</a>
<a href="https://feedback.example.com/roadmap">Roadmap</a>
<a href="https://feedback.example.com/updates">Updates</a>

Embedded pages use the same mechanism: an embed created after identify starts signed in. See Embedding pages inline.

A typical pattern is to identify once your session is ready and log out when the user does:

if (user) {
  uj.identify({ token: user.userJotToken });
} else {
  uj.logout();
}

Identify users covers the full identify payload.

Limitations

• Automatic login does not work for admin or owner accounts. Test with a normal end-user account.

• It applies to public UserJot pages. It is not workspace SSO, and it is different from Single sign-on, which replaces the board's login button with your own authentication.

• When signed tokens are required, a missing or invalid token fails the whole identify call, so the user arrives signed out.

Troubleshooting

The user still sees a login prompt

• Automatic login is on in Settings → Login.

• The SDK is loaded on the page where the UserJot link lives.

• identify runs before the user opens the link.

• The link points to your actual UserJot domain or custom domain.

Signed tokens are required, but automatic login still fails

• identify was called with a token, not only user.

• The token was signed on your server with HS256 and the current Project secret.

• iss is your Project ID, aud is exactly userjot, and the token has not expired.

• Check the identify result: a rejected promise with IDENTIFY_FAILED means the token was refused.