Signed Links

Using the iOS SDK? You don’t need signed links. The SDK handles authentication automatically via FeatKit.identify(). This page is for web apps and custom integrations.

Signed Links let you authenticate users from your backend without exposing credentials in client code. Use this approach when:

Building a web app that opens the portal
Creating a custom integration without the SDK
Supporting non-iOS platforms
Needing server-controlled authentication

How it works

Your backend generates a signed URL with user info
Your app/website opens this URL
User is automatically authenticated on the portal
Votes and submissions are tied to their identity

What you need

Project Slug — from Project Settings → General
Secret Key — from Project Settings → Signed Links
User info: ID (required), email (optional), name (optional)

Generating a Signed Link

Your backend creates a signed token with user data using HMAC-SHA256.

Signature structure

Payload: { user_id, email, name, timestamp, expires }
Signature: HMAC-SHA256(base64(payload), secret_key)
Final URL: https://featkit.com/p/[slug]?token=[base64payload].[signature]

Code examples

import hmac
import hashlib
import base64
import json
import time

def generate_signed_link(slug, secret_key, user_id, email=None, name=None):
    payload = {
        "user_id": user_id,
        "email": email,
        "name": name,
        "timestamp": int(time.time()),
        "expires": int(time.time()) + 86400  # 24 hours
    }
    payload_json = json.dumps(payload, separators=(',', ':'))
    payload_b64 = base64.urlsafe_b64encode(payload_json.encode()).decode()
    signature = hmac.new(secret_key.encode(), payload_b64.encode(), hashlib.sha256).hexdigest()
    return f"https://featkit.com/p/{slug}?token={payload_b64}.{signature}"

const crypto = require('crypto');

function generateSignedLink(slug, secretKey, userId, email = null, name = null) {
  const payload = {
    user_id: userId,
    email: email,
    name: name,
    timestamp: Math.floor(Date.now() / 1000),
    expires: Math.floor(Date.now() / 1000) + 86400 // 24 hours
  };
  const payloadJson = JSON.stringify(payload);
  const payloadB64 = Buffer.from(payloadJson).toString('base64url');
  const signature = crypto.createHmac('sha256', secretKey).update(payloadB64).digest('hex');
  return `https://featkit.com/p/${slug}?token=${payloadB64}.${signature}`;
}

require 'openssl'
require 'base64'
require 'json'

def generate_signed_link(slug, secret_key, user_id, email: nil, name: nil)
  payload = {
    user_id: user_id,
    email: email,
    name: name,
    timestamp: Time.now.to_i,
    expires: Time.now.to_i + 86400 # 24 hours
  }
  payload_json = payload.to_json
  payload_b64 = Base64.urlsafe_encode64(payload_json, padding: false)
  signature = OpenSSL::HMAC.hexdigest('sha256', secret_key, payload_b64)
  "https://featkit.com/p/#{slug}?token=#{payload_b64}.#{signature}"
end

Using in a web app

// Frontend: Request signed URL from your backend
const response = await fetch('/api/featkit-link');
const { url } = await response.json();

// Open in new tab or redirect
window.open(url, '_blank');

// Backend (Express example)
app.get('/api/featkit-link', (req, res) => {
  const url = generateSignedLink(
    process.env.FEATKIT_SLUG,
    process.env.FEATKIT_SECRET,
    req.user.id,
    req.user.email,
    req.user.name
  );
  res.json({ url });
});

Token expiration

Tokens should expire. Recommended: 24 hours. Set the expires field to timestamp + 86400.

Shorter expiration times (1-4 hours) are more secure but require more frequent token generation.

Testing

Generate a test link in your dashboard: Project Settings → Signed Links → Test Link Generator This lets you verify your integration without deploying backend changes.

Security notes

Never expose your Secret Key in client code. Generate tokens on your backend only.

Store your Secret Key securely (environment variables, secrets manager)
Generate tokens server-side only
Use HTTPS for all requests
Set reasonable expiration times

Getting Started

Integration

Customization

Signed Links

Signed Links

How it works

What you need

Generating a Signed Link

Signature structure

Code examples

Using in a web app

Token expiration

Testing

Security notes

​Signed Links

​How it works

​What you need

​Generating a Signed Link

​Signature structure

​Code examples

​Using in a web app

​Token expiration

​Testing

​Security notes

Signed Links

How it works

What you need

Generating a Signed Link

Signature structure

Code examples

Using in a web app

Token expiration

Testing

Security notes