Identity

Bootstrapware does not authenticate end users. Your host app asserts identity from your own session:

<Onboard
  user={{ id: "opaque-stable-id", name: "Ada" }}
  workspaceKey={workspace.id}
  authorToken={tokenFromYourBff}
  // ...
/>

Dual scope

user.id scopes personal steps. workspaceKey scopes shared workspace steps. Both are host-asserted opaque strings.

authorToken

Mint a short-lived assertion with your Onboard secret key from your BFF session (never the browser):

POST https://onboard.bootstrapware.co/api/v1/author-tokens
Authorization: Bearer bsw_live_sec_...
{
  "authorId": "user_123",
  "flowId": "flw_...",
  "workspaceKey": "ws_acme",
  "expiresInSec": 3600
}
  • Live Hosted requires authorToken when requireAuthorToken: true.
  • Test keys can write tokenless for development only.
  • Default permissions: complete, skip, dismiss, snooze. Include reset to show Reset my progress.

Reset my progress

Resets personal scope only. Workspace-scoped steps are unchanged. Requires reset in token permissions.

Threat model

  • Restrict origins on published flows.
  • Never put secret keys in client bundles.
  • On BYO, enforce authz on your progress API from the signed-in session.

Related: Origins · Progress · Identity guide