FastComments Secure SSO

Your server already knows who the user is. Secure SSO hands that identity to the widget, signed, so the user never sees a second login. There are no new endpoints to build and nothing to call at runtime: you compute three values server-side and pass them in the widget config.

The flow

1. Your server serializes the user to JSON and Base64-encodes it.
2. Your server computes verificationHash = HMAC_SHA256(UNIX_TIME_MILLIS + userDataJSONBase64, apiSecret). The message is the timestamp string concatenated with the Base64 string, in that order.
3. Your page passes sso: { userDataJSONBase64, verificationHash, timestamp, loginURL, logoutURL }.
4. The widget authenticates the user on load.

The API secret comes from https://fastcomments.com/auth/my-account/api-secret (EU accounts use the eu. host). It must stay on the server. If it reaches browser code, anyone can impersonate any user on your site, so rotate it immediately if that happens.

The sso object