Overview
To securely allow users to resume their session on a different device, you’ll need to:- Create a Token Signing Secret for your project in the Embeddables dashboard.
- Use that secret to generate a Hashed Token from the user’s Entry ID and an expiration timestamp.
- Send users a secure URL containing the Hashed Token, Entry ID, and expiration timestamp.
- When a user opens the URL, use the Hashed Token and other parameters to call the Embeddables API from the client, which will return the User Data.
- Use the retrieved User Data to restore the user’s session.
Setting up your Token Signing Secret
Create a new credential
Click + New Internal Credential.
- Set Key type to Token Signing Secret.
- Choose the production Environment.
- Add a descriptive Label (e.g.
Token Signing Secret).
Generating the Hashed Token and secure URL
Use the secret from the previous step to generate a signed token on your backend:Client-side implementation
Create an Action in your Embeddable, triggered on Embeddable Load, with the following code to fetch and restore the user’s session:Important Notes
- Your Token Signing Secret should always be stored as an encrypted backend environment variable and never exposed in client-side code.
- Each URL should have a reasonable expiration window, e.g. 7 days or 30 days.
- The Hashed Token is unique per user and expiration date.
Troubleshooting
If you’re experiencing issues:- Verify that the secret key is correctly set in your environment variables.
- Ensure the expiration timestamp is in ISO 8601 format (e.g.
2025-01-01T00:00:00.000Z). - Check that all URL parameters (
token,entry_id,expires_at) are properly URL-encoded. - Confirm the
project_idin the POST body matches the project your Token Signing Secret belongs to. - Make sure you’re using a Token Signing Secret created under Settings → Credentials & Endpoints — legacy per-flow keys are no longer provisioned and the legacy endpoint does not accept these credentials.
Legacy endpoint (deprecated)
Legacy endpoint (deprecated)
If you set up this feature before May 26, 2026, your integration may be using the legacy endpoint. It remains functional for existing keys but will not accept credentials created through the Embeddables dashboard.Legacy endpoint:
Legacy client code (for reference only):To migrate, follow the Setting up your Token Signing Secret section above and update your client code to use the new endpoint and POST body.
https://ierxexdtyashuotcsjyo.supabase.co/functions/v1/load_entry_dataDifferences from the current endpoint:| Legacy | Current | |
|---|---|---|
| Endpoint | Legacy endpoint (above) | https://load-entry-data-worker.heysavvy.workers.dev |
expires_at field name | expires | expires_at |
project_id in body | Not required | Required |
| Key provisioning | Contact Embeddables support | Self-service via Settings |

