Tribe Community Platform

The Tribe Community Platform Developer Hub

Welcome to the Tribe Community Platform developer hub. You'll find comprehensive guides and documentation to help you start working with Tribe Community Platform as quickly as possible, as well as support if you get stuck. Let's jump right in!

Get Started    

Authentication

In many cases, the user is already logged-in inside your product or phone app and you want to automatically log them in inside the Tribe widgets for a seamless experience. To do so, there are three different authentication methods available for Tribe widgets.

JWT (JSON Web Token)

JWT is the most common way of authenticating users on Tribe widgets.

In this method, you'll sign a JSON web token with User's information using a private key. Then the generated token should be passed as jwt in the query string or widget options.

👍

For more details, please check the JWT SSO section.

To generate the JWT token, first you need to get your Single Sign-On private key. Login to your community as an Admin. In the Admin Panel under Apps, install the "JWT SSO" app and you should find the Single Sign-On private key there.

🚧

JWT SSO app should not be confused with JWT Authorization app. The "JWT Authorization" app is used to authenticate API requests using JWT Tokens and is not relevant to authenticating widgets.

Next, you should first install a JWT library:

npm install --save jsonwebtoken
composer require firebase/php-jwt
# See instructions here:
https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt/0.7.0
pip install PyJWT
sudo gem install jwt

Then use the following source code and the SSO private key inside the Tribe "JWT SSO" app to generate the JWT token:

var jwt = require('jsonwebtoken');

var privateKey = '{Your Private Key}';

function createToken(user) {
  var userData = {
    email: user.email,
    id: user.id,
    name: user.name,
    iat: Math.round(new Date().getTime() / 1000), // token issue time
    exp: Math.round(new Date().getTime() / 1000) + 60, // token expiration time
    picture: user.picture, // optional but preferred
    locale: user.locale, // optional
    title: user.title, // optional
    bio: user.bio, // optional
  };
  return jwt.sign(userData, privateKey, {algorithm: 'HS256'});
}
use FirebaseJWTJWT;

const privateKey = '{Your Private Key}';

function createToken($user) {
  $userData = [
    'email' => $user['email'],
    'id' => $user['id'],
    'name' => $user['name'],
    'picture' => $user['picture'], // optional but preferred
    'locale' => $user['locale'], // optional
    'title' => $user['title'], // optional
    'bio' => $user['bio'], // optional
  ];
  return JWT::encode($userData, privateKey, 'HS256');
}
import java.util.HashMap;

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

public class TokenCreator {
  private static final String privateKey = "{Your Private Key}";

  public static String createToken(User user) throws Exception {
    HashMap<String, Object> userData = new HashMap<String, Object>();
    userData.put("email", user.email);
    userData.put("id", user.id);
    userData.put("name", user.name);
    userData.put("picture", user.picture); // optional but preferred
    userData.put("locale", user.locale); // optional
    userData.put("title", user.title); // optional
    userData.put("bio", user.bio); // optional

    return Jwts.builder()
               .setClaims(userData)
               .signWith(SignatureAlgorithm.HS256, privateKey.getBytes("UTF-8"))
               .compact();
  }
}
import jwt

private_key = '{Your Private Key}'

def create_token(user):
  user_data = {
    'email': user.email,
    'id': user.id,
    'name': user.name,
    'picture': user.picture, # optional but preferred
    'locale': user.locale, # optional    
    'title': user.title, # optional
    'bio': user.bio, # optional
  }
  return jwt.encode(user_data, private_key, algorithm='HS256')
require 'jwt'

privateKey = '{Your Private Key}'

def createToken(user)
  userData = {
    :email => user[:email],
    :id => user[:id],
    :name => user[:name],
    :picture => user[:picture], # optional, but preferred
    :locale => user[:locale], # optional
    :title => user[:title], # optional
    :bio => user[:bio], # optional
  }

  JWT.encode(userData, privateKey, 'HS256')
end

Finally, you should pass the generated JWT token to your widget. Here is how a Topic Widget snippet looks like with JWT:

<div id="topic-widget"></div>
<script>
  window.Tribe('topic', {
    id: 'topic-widget', 
    topicId: '5babe5eb3d9228aa7c423c66', 
    components: ['input', 'feed'],
    jwt: '{The generated JWT token from the backend}'
  })
</script>

As mentioned, alternatively, you can pass it as a query string to your iframe or WebView:

<iframe
  src="https://community.tribe.so/embed/topic/community-management/questions?components=input,feed&feedLimit=5&jwt={The generated JWT token from the backend}"
  frameborder="0"
  width="100%"
  style="min-height: 300px; width: 100%;"
  allowtransparency="true">
</iframe>

OAuth2

To use this method you need to first install and enable the "OAuth2" app.

To make sure the user is logged in inside your widget you should pass auth=true option to your widget. When this option is set, the widget will do as follows:

  • If the user is not logged in, it will redirect the user to the OAuth2 workflow and it'll log user in.
  • If the user is already logged in, it won't do anything.

Please note that this method works seamlessly if the user is already authenticated in the OAuth2 provider. For instance, on the web, you're already sure that the user is authenticated to your app using the OAuth2 provider, therefore when the widget redirects user to the OAuth2 workflow user will be logged in and redirected back right away.

If the user is not authenticated using the OAuth2 provider, they will see the OAuth2 login screen inside the widget and it won't be a seamless experience. This mostly happens when you're using a WebView inside your app, and the WebView has a different session from the main App's authentication flow. We suggest using JWT Token if this is the case.

Session

If you don't have a separate userbase or want Tribe to handle authentication, this is the right authentication method.

The widget will check your Tribe community to see if the user is logged in there. If they are not, we'll show a Signup/Login button inside the widgets.

User can click on the button and login in and the platform will return user to the previous widget page right after the user is authenticated.

Updated 2 months ago


What's Next

JWT SSO

Authentication


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.