Sign-on link

On a hosted page or custom domain the visitor is a stranger to us. A sign-on link tells the page who they are, using your Secret key. Use it to show a private board, to attribute votes to a customer and account, or to skip asking for an email.

Embedded boards do not need this: they use the session from identify().

How it works

1. Your server builds a short-lived signed link for the logged-in user.
2. The user opens it. We check the signature, set a first-party cookie and redirect to the same URL without the token.
3. The page now knows the user. A verified identity can read a private board.

The link expires after at most 10 minutes and works once. The secret never leaves your server.

Token format

base64url(JSON payload) + "." + hex(HMAC-SHA256(Secret key, base64url payload))

The Secret key is under Settings > Developers > Secret key (it is shown once, when you generate it). Never put it in browser code.

Code

The dashboard card Sign-on link and the MCP server generate ready code for Node.js, Python, PHP, Ruby, Go and Java. Node.js example:

import { createHmac } from "node:crypto";

// Server only.
export function boardSignOnUrl(base: string, secret: string, user: { id: string; email: string; name: string }, path = "/roadmap") {
  const payload = Buffer.from(
    JSON.stringify({ userId: user.id, email: user.email, name: user.name, exp: Math.floor(Date.now() / 1000) + 300, nonce: crypto.randomUUID() }),
  ).toString("base64url");
  const signature = createHmac("sha256", secret).update(payload).digest("hex");
  return `${base}${path}?jocx_token=${payload}.${signature}`;
}

Use the generated code from the dashboard as the source of truth for field names.