Authenticated help centers
Authenticated help centers let you gate access to your Brainfish-hosted Help Center so only signed-in users from your application can view it. Brainfish supports this via JWT tokens configured on your Help Center Agent.
How it works
- Your application authenticates the user and issues a JWT signed with a shared secret.
- The Brainfish Help Center page calls your authentication endpoint to verify the user is signed in (cookie-based) or accepts the JWT directly.
- Brainfish validates the JWT against the secret you've configured and serves help center content only if validation succeeds.
Configure JWT authentication in Brainfish
- Open the Distribution tab, then choose your Help Center agent.
- Scroll to Advanced Settings and expand it.
- Under Authentication, paste your JWT shared secret. Save changes.
Once that's saved, your Help Center will require a valid JWT (or a valid authenticated session, depending on how you wire it up) before serving content.
Example: checking authentication via a cookie
Below is a sample fetch you can add to your help center page (or your application shell) to check whether the user is authenticated using a cookie issued by your own application:
// Replace this URL with your authentication API endpoint
const authApiUrl = "https://your-auth-api.com/is-authenticated";
function checkUserAuthentication() {
fetch(authApiUrl, {
method: "GET",
credentials: "include" // send cookies along with the request
})
.then((response) => {
if (response.ok) return response.json();
throw new Error("Error fetching authentication status");
})
.then((data) => {
if (data.isAuthenticated) {
console.log("User is authenticated");
} else {
console.log("User is not authenticated");
}
})
.catch((error) => {
console.error("Error:", error);
});
}
checkUserAuthentication();
Replace authApiUrl with your own authentication API endpoint. The endpoint should read the user's session cookie and return a JSON body like { "isAuthenticated": true }. With credentials: "include", the fetch sends cookies along with the request so your endpoint can verify the session.