Choose how visitors sign in
Let visitors sign in to your public site with a Median account, your own app, or an OpenID Connect provider.
Signing in lets visitors post, vote, comment and follow on the feedback board, and keeps their support chat across devices. The help center never asks.
| Method | Visitors sign in with | Setup | Same customer as the widget |
|---|---|---|---|
| Median accounts | A free Median account | None | No. Matched by email address |
| Your app (recommended) | Their account in your product | One route in your app, added by your developer | Yes |
| OpenID Connect | Your identity provider, like Auth0 or Okta | The provider's details | When your widget signs the same sub |
Pick one under Site → Sign-in. Admins and owners only. Switching signs out everyone who signed in another way.
Median accounts
The default. There is nothing to set up.
| Fact | Detail |
|---|---|
| What visitors see | Sign in to Acme on median.sh, with Continue and Cancel once they are signed in to Median |
| Not signed in to Median | Continue opens Median's sign-in page, where they sign in or make a free account, then come back to approve |
| What you get | Their name, email and picture |
| Chat history | Joins whatever that email address sent you before, like email to your support address |
Your app
Visitors sign in with the account they already have in your product. Their site chat and their widget chat are one history.
-
Add the route
Your developer adds one route to your app. It is the same route the widget reads to know who is signed in. See Site sign-in in the developer docs.
-
Paste its URL
Under Site → Sign-in, pick Your app, paste the route's full https URL, and press Use your app.
-
Try it
Open your site and press Sign in.
OpenID Connect
-
Create an app at your provider
A regular web application using the authorization code flow. Add the Redirect URI from Site → Sign-in to its allowed callback URLs:
https://api.median.sh/sites/oidc/callback. Allow theopenid,emailandprofilescopes. -
Add its details
Pick OpenID Connect. Enter the issuer URL, client ID and client secret, and press Use OpenID Connect.
| Provider | Issuer URL |
|---|---|
| Auth0 | https://<tenant>.<region>.auth0.com |
| Okta | https://<org>.okta.com, or a custom authorization server's URL |
| Clerk | Your Frontend API URL. Turn on the openid scope on the OAuth application |
https://accounts.google.com | |
| Microsoft Entra ID | https://login.microsoftonline.com/<tenant-id>/v2.0 |
| Fact | Detail |
|---|---|
| Issuer | Checked when you save. The provider has to call itself by the issuer you entered |
| Required. A visitor whose provider says the email is not verified is refused | |
| Client secret | Never shown again. The page shows its last 4 characters. Leave it blank to keep it |
| New client | Enter the secret again when the issuer or client ID changes |
| Same customer as the widget | When your app signs the widget's user with the same id the provider gives them |
The protocol details are in Site sign-in in the developer docs.
What signing in does
| Where | Signed in | Signed out |
|---|---|---|
| Header | Their picture or initial, with Sign out | Sign in, when Support or Feedback is on |
| Feedback | Post, vote, comment and follow. A vote, follow or comment pressed before signing in goes through after, and a post reopens with its draft. Images have to be attached again | Read only |
| Support | The chat follows them across devices, with no email prompt. With your app or OpenID Connect it is the widget's history too, and your tools know who they are | The chat belongs to this browser. With your app or OpenID Connect, the agent can put a Sign in button under a reply when one of your tools needs to know who they are, and the foot of the history offers Sign in beside Email a code |
| Help center | No change | No change |
| Fact | Detail |
|---|---|
| Session | 30 days |
| Sign out | Ends the session and starts a fresh chat in that browser |
| Before signing in | Anything the visitor said in the chat joins their signed in history |
| Addresses | Works on <slug>.median.website and a live custom domain |
| Time limit | A sign-in has 15 minutes to finish |
Troubleshooting
What visitors and the dashboard can say, and what to do about it, is in Fix public site problems.