Shipnoted
Start free
ProductDesignPricingCompareDocsSign in

Docs

Verified users

Sign your customers in: revenue-weighted votes and segments.

Verified users#

On Pro and Team, your own backend can tell Shipnoted who is signed in. Their votes and ideas then count as one verified person on every device, carry a “Verified” mark, and the person is emailed when their request ships, with no form to fill in.

Sign a short JWT on your server with the identify secret from Install & connect. It must be HS256 and carry sub (your id for the person) and exp (at most 30 days away); email and name are optional.

Revenue-weighted votes. Add plan (text, such as “Enterprise”), mrr (the customer’s monthly revenue in dollars, a plain number) and company. Shipnoted then shows how much revenue sits behind each request, lets you sort the board by it and filter by plan, and groups requests into Themes ranked by revenue. A missing or malformed value simply counts as unknown.

Segments. Any other fact about the customer can go in an attrs object, such as { beta: true, region: "eu" } (up to 8 short keys; values are text, numbers or true/false). Filter the board by any of them, and aim a release at a group (plan:pro, beta:true): it stays off the public changelog, appears in the widget for signed-in customers in that group, and is emailed to voters in it.

import { SignJWT } from "jose"

const token = await new SignJWT({ email: user.email, name: user.name })
  .setProtectedHeader({ alg: "HS256" })
  .setSubject(user.id)
  .setExpirationTime("1h")
  .sign(new TextEncoder().encode(process.env.SHIPNOTED_IDENTIFY_SECRET))

Then pass it to whichever surface you use:

<!-- the widget -->
<script src="https://shipnoted.com/widget.js" data-project="your-slug" data-user-token="TOKEN" async></script>
<script>Shipnoted.identify("TOKEN")</script>

// the components
<FeedbackBoard project="your-slug" userToken={token} />

// the hosted board
https://shipnoted.com/p/your-slug/feedback?sn_token=TOKEN
  • An invalid, forged or expired token gets a 401 (code: "bad_token"); the widget then carries on anonymously.
  • Keep the secret on your server. Rotating it invalidates every token signed with the old one.
  • On the Free plan the token is ignored and visitors stay anonymous.