Publisher SSO

SSO via Identity Token

Sign a JWT on your server and pass it to the official embed script. Readers authenticate without a Threadline signup form. There is no <threadline-comments> custom element.

Embed format

embed.html

<script
  src="https://threadline.io/api/embed"
  data-site-id="tl_pub_xxx"
  data-identity-token="SIGNED_IDENTITY_TOKEN"
  async>
</script>

<div id="threadline-comments"></div>

Token requirements

AlgorithmHS256
Claimssub, email, display_name, iat, exp
IssuerYour publication domain
Audiencethreadline
Expiration1 hour or less
SecretSSO secret from Site Settings → Install

Backend examples

Generate the token on your server, then inject it into the page that hosts the embed.

Install

npm install jsonwebtoken
# or: yarn add jsonwebtoken

Sign identity tokenNode.js

const jwt = require('jsonwebtoken');

const token = jwt.sign(
  {
    sub: user.id,
    email: user.email,
    display_name: user.name,
  },
  process.env.THREADLINE_SSO_SECRET,
  {
    expiresIn: '1h',
    issuer: 'your-site.com',
    audience: 'threadline',
  }
);

// Pass token into data-identity-token on the embed script

Never ship the SSO secret to the browser. Sign tokens server-side only, and refresh them before exp.

ReferenceEmbed options

All data-* attributes for the widget script.

SetupYour first site

Create a site and grab install credentials.