User Authentication / Single sign-on

Roadmaps support user authentication, so that your existing users/customers can login to the roadmap and keep track of their upvotes and requested features.

You handle user authentication and then provide a signed JWT to Produktly, which will authenticate the user on your roadmap.

Instructions

1. Add your login / sign-up page URL to the roadmap under "User Authentication" -> "Login / Signup URL"

2. Generate a private key in Produktly. This will be used to verify that the user is from your system.

3. Add logic to generate and sign the JWT for the currently authenticated user.

   a. User clicks on "Login" on your Produktly roadmap

   b. Produktly redirects the user to your login page

   c. User logins with their existing credentials (or you can also check if they are already logged in)

   d. You verify the user is logged in, and generate a JWT that contains: the user's id, their email, name and optionally avatar.

     {
       id: string | number,
       email: string,
       name: string,
       avatarUrl?: string,
     }

   e. Sign the generated JWT with your private key. Note that this should happen server-side so that your private key stays secure.

   f. After you have the signed JWT, you should redirect the user back to your roadmap, and include the signed JWT as a query param ?authToken=

Code examples

Code examples are high-level and for illustrative purposes, the exact implementation will of course depend on your codebase and on what technologies you use.

Client-side

For example, the code could look something like this on the client-side:

if (userIsLoggedIn) {
  const produktlyAuthToken = await getUserProduktlyToken()

  window.location.href = `https://roadmap.example.com?authToken=${produktlyAuthToken}`
}

...

const onLogIn = async (...) => {
  const user = await login(...)

  const produktlyAuthToken = await getUserProduktlyToken()

  window.location.href = `https://roadmap.example.com?authToken=${produktlyAuthToken}`
}

Server-side

And on server-side to sign the token with Node.js:

import jwt from "jsonwebtoken";

const getUserToken = (user) => {
  const data = {
    id: user.id,
    email: user.email,
    name: `${user.firstName} ${user.lastName}`,
    avatarUrl: null,
  }

  const token = jwt.sign(
    data
    process.env.PRODUKTLY_PRIVATE_KEY,
    { expiresIn: "30d" } // Optionally add e.g. expiration time 
  )

  return token
}

// Endpoint for getting user token
router.post("/auth/externals/produktly", async (req, res) => {
  // Get current user
  const user = await ...

  // Get and sign the token
  const produktlyToken = getUserToken(user)

  // Return token back to the client
  res.send({ produktlyToken })
})