Frill
The Frill Script

Configuring SSO with the Frill Script

Single Sign-On (SSO) lets you securely identify users in Frill without exposing their email or data in client-side JavaScript. Instead of passing user details directly, you generate a signed token on your server and pass that to the Frill Script.

Use SSO when you need to prevent users from impersonating others or viewing another user's profile data.

Before you begin: You'll need your SSO secret key from Settings > SSO.

Get your SSO Secret Key

  1. Go to Settings > Single Sign-On

  2. Choose the Frill SSO provider

  3. Copy your SSO Secret Key, you'll use this to sign tokens on your server

If you're using Microsoft Entra ID or Okta, you can find the SSO Secret Key under Additional settings at the bottom of the page.

Keep your SSO secret key private. Never expose it in client-side code or public repositories.

Generate an SSO token

On your server, create a JWT (JSON Web Token) signed with your SSO secret key using the HS256 algorithm. The token payload should include user data:

{\n  \"email\": \"[email protected]\",\n  \"name\": \"Jane Doe\",\n  \"externalId\": \"user_12345\",\n  // Optional\n  \"attributes\": {\n    \"plan\": \"business\",\n    \"mrr\": 150\n  },\n  // Optional\n  \"companies\": [{\n    \"id\": \"acme-corp\",\n    \"name\": \"Acme Corp\"\n  }]\n}

Pass this token to your frontend—typically in a template variable or API response.

See our Token-based authentication guide for a complete walkthrough and examples on how to generate the SSO token.

Use the SSO token in the Frill Script

Replace the user object in your Frill Script with ssoToken:

window.Frill('container', {\n  key: 'YOUR_CONTAINER_KEY',\n  ssoToken: 'YOUR_GENERATED_SSO_TOKEN'\n});

The Frill Script validates the token signature. If valid, it extracts the user data and identifies them securely. If invalid, you'll see a console warning and the user remains anonymous.

Troubleshooting

If SSO isn't working:

  • Check your browser console for warnings like "ignored because it is not a valid JWT"

  • Confirm you're using the HS256 algorithm

  • Verify the SSO secret key matches what's in your Frill settings

  • Ensure the token is generated server-side, not in client JavaScript

Was this helpful?
Was this helpful?