Identity

Bootstrapware does not authenticate board end users. Your host app asserts the author from your own session:

<Feedback
  user={{ id: "opaque-stable-id", name: "Ada" }}
  authorToken={tokenFromYourBackend}
  // ...
/>

Author fields

Field	Required	Notes
id	yes	Opaque and stable for the same person across sessions. Used for vote uniqueness.
name	no	Display only.
email	no	Display / moderation metadata only, not login.
avatarUrl	no	Display only.

Threat model

Publishable keys (bsw_test_pub_ / bsw_live_pub_) are browser-visible by design. Anyone who can call Hosted widget routes with a leaked publishable key can forge author.id unless you require a signed authorToken. Treat that as a trust boundary:

Restrict allowed origins so random sites cannot call your live Feedback API from a browser.
Enable requireAuthorToken on the board and mint tokens server-side with your secret key.
Never put secret keys (bsw_*_sec_) in client bundles or NEXT_PUBLIC_ / VITE_ env vars.
On BYO, enforce authz on your API from the signed-in session, do not trust the browser-supplied author alone.

authorToken

Mint a short-lived assertion with your Feedback secret key, then pass it into the embed:

POST https://feedback.bootstrapware.co/api/v1/author-tokens
Authorization: Bearer bsw_live_sec_...
{ "authorId": "user_123", "boardId": "brd_...", "expiresInSec": 3600 }

When the published board has requireAuthorToken: true, Hosted create/vote reject requests without a valid token that matches author.id (and optional boardId). If a token is present, it is always verified even when the board does not require one.

What we never are

Not an end-user IdP (no passwords, OAuth, or magic links for board visitors).
Not a substitute for your product login cookie or session.
Not a channel that makes Hosted content private by default, plain text; you moderate.

Related: Origins · Adapter · Security · Identity guide