JWT Auth

If your product already issues JWTs, the goal is simple: make public feedback traffic honor the same trust boundary.

How it works

Configure App Security with your issuer and JWKS. Once enabled, public survey requests must carry a valid bearer token.

• Tokens are verified per app.
• The expected audience is fixed to https://api.getuserfeedback.com.
• Missing or invalid tokens fail with explicit error codes.

When security is disabled, requests still work without a token. If you do send one, it is still validated and failures are logged for debugging.

What the client needs to send

Send:

Authorization: Bearer <token>

The browser surfaces support runtime auth configuration:

await client.configure({ auth: { jwt: { token } } });

await client.reset(); // on logout

Failure behavior

When security is enabled, the important failure modes are explicit:

• missing_token
• config_missing
• config_invalid
• invalid_token

These are useful because they tell you whether the problem is with the request, the app configuration, or the token itself.

Practical rollout checklist

Before you enable security broadly:

1. confirm the app is pointing at the correct issuer and JWKS
2. verify the client actually sends the token on survey requests
3. verify the token audience matches https://api.getuserfeedback.com
4. test one happy path and one failure path on purpose