Configure Canny Widget Single Sign-On

Use Canny’s SSO key settings and store the value in a server environment variable. Do not copy it into the frontend build configuration.

Install jsonwebtoken in the backend package. Wire token generation to an endpoint that requires your existing authenticated session.

Use the server-resolved user, as in the example. The function expects the caller to provide an authenticated user; it is not a public endpoint by itself.

const jwt = require('jsonwebtoken');

function createCannyToken(authenticatedUser) {
  const key = process.env.CANNY_SSO_KEY;
  if (!key) throw new Error('CANNY_SSO_KEY is required');
  return jwt.sign({
    id: String(authenticatedUser.id),
    email: authenticatedUser.email,
    name: authenticatedUser.name
  }, key, { algorithm: 'HS256', expiresIn: '5m' });
}

Expose an authenticated /api/canny/sso handler that returns {ssoToken: createCannyToken(sessionUser)}. After installing the official SDK bootstrap and container, render with the returned token as shown. Configure your router so /feedback/* reaches this page and set the board Widget URL accordingly.

<div data-canny></div>
<script type="module">
  const response = await fetch('/api/canny/sso', {
    credentials: 'same-origin'
  });
  if (!response.ok) throw new Error('Canny authentication failed');
  const { ssoToken } = await response.json();
  if (!ssoToken) throw new Error('Missing SSO token');
  Canny('render', {
    boardToken: 'YOUR_BOARD_TOKEN',
    basePath: '/feedback',
    ssoToken,
    theme: 'light'
  });
</script>

Use Canny’s token validation tool with a sample identity, then test the real widget. Check expired-token handling and the logged-out state before broad rollout.