Frill
User Management

Single Sign-On (SSO) for widget users

Widget SSO identifies your customers when they interact with embedded Frill widgets. This lets you personalize content, track user activity, control access to private boards, and prevent duplicate accounts—all without requiring users to log in separately to Frill.

Widget SSO requires the Growth plan or higher.

How widget SSO works

Your application authenticates users, then passes a JWT token to Frill's widget script. Frill reads the token to identify the user and apply personalization or access controls.

Users never see a Frill login screen—authentication happens behind the scenes using your existing session.

Setting up widget SSO

To enable widget SSO:

  1. Generate a secret key in Settings > SSO > Widget Authentication

  2. On your server, create a JWT token containing user information (email, name, custom attributes)

  3. Pass the token to your Frill widget script via the ssoToken parameter

Example widget code with SSO:

Frill.widget('widget_id', {
  ssoToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
  user: {
    email: '[email protected]',
    name: 'Jane Doe'
  },
  attributes: {
    plan: 'business',
    company: 'Acme Corp'
  }
});

What you can do with widget SSO

Once configured, widget SSO enables:

  • User tracking: Track votes, ideas, and comments by authenticated users

  • Private boards: Restrict widget access to authenticated users only

  • Personalization: Show different content based on user attributes

  • Segmentation: Target announcements or surveys to specific user groups

  • Duplicate prevention: Ensure each user has one account even across devices

Token requirements

Your JWT token must include:

  • email: User's email address (required)

  • name: User's display name (optional but recommended)

  • exp: Token expiration timestamp (recommended for security)

You can also include custom attributes like plan type, MRR, company, or any other user metadata for segmentation.

Security considerations

Keep your SSO secret key secure—anyone with the key can generate tokens for your workspace. Store it as an environment variable and never expose it in client-side code.

Set token expiration times appropriate for your session length (typically 1-24 hours). Users automatically re-authenticate when the token expires.

For detailed implementation examples and token structure, see the SSO developer documentation.

Widget SSO vs. team SSO

Widget SSO is for end-users interacting with your feedback boards. Team SSO is for internal colleagues accessing the dashboard. These work independently. See Single Sign-On (SSO) for team members for team SSO details.

Was this helpful?
Was this helpful?