Skip to content
Reqio
Get started

HomeDocsDeveloperNode.js and Next.js

Developer

Node.js and Next.js

Mint Reqio HS256 identity tokens on a Node.js or Next.js server using the jose library.

The snippet below is exactly what the dashboard generates under Project > Settings > Identity when you choose Next.js or Node.js. Copy it from the dashboard to get your real project ID and audience URL pre-filled.

Before you start

  • A Reqio project
  • A signing secret generated at Project > Settings > Identity

  1. Install jose

    Install

    npm install jose

  2. Mint a token

    // npm install jose
import { SignJWT } from "jose";
 
const secret = new TextEncoder().encode(process.env.REQIO_SECRET!);
const now = Math.floor(Date.now() / 1000);
 
const token = await new SignJWT({
  sub: user.id,
  email: user.email,
  traits: {
    // amount in cents; interval is "month" | "year"
    plan: user.plan,
    amount: user.planAmount,
    interval: user.billingInterval,
    // optional CRM enrichment: 0-100 health, CRM account id, ISO renewal date
    healthScore: account.healthScore,
    accountId: account.crmId,
    renewalAt: account.renewalAt,
  },
})
  .setProtectedHeader({ alg: "HS256" })
  .setAudience("https://reqio.app/p/YOUR_PROJECT_ID")
  .setIssuedAt(now)
  .setExpirationTime(now + 300)
  .sign(secret);

    Replace YOUR_PROJECT_ID with your project ID, or copy the full snippet from the dashboard where the audience URL is pre-filled.

  3. Set the environment variable

    Set REQIO_SECRET to the signing secret from Project > Settings > Identity > Reveal secret. Store it server-side only; never expose it to the browser.

    Environment variable

    REQIO_SECRET=your-signing-secret

  4. Pass the token to the widget

    For server-rendered pages, pass the token inline on the script tag so no client fetch is needed:

    <script
  src="https://reqio.app/widget.js"
  data-project-id="YOUR_PROJECT_ID"
  data-identity-token="<your minted token>"
  async
></script>

    For SPAs where the user authenticates after the initial page load, call window.Reqio.identify() after login:

    window.Reqio.identify(token);

Traits reference

planstring
Plan name on your billing system, e.g. "pro".
amountnumber
Recurring charge as billed, in cents. For annual plans send the full annual total; Reqio divides by 12 to derive the monthly value.
interval"month" | "year"
Billing cadence for amount.

CRM enrichment

healthScorenumber
CRM account-health score, 0-100. Reqio clamps out-of-range values.
accountIdstring
Your CRM's external account id. Not displayed, a matching key for a future CRM sync (email first, accountId fallback).
renewalAtstring (ISO 8601 date)
Next renewal date. Unparseable values are dropped by Reqio.

Security

REQIO_SECRET is the symmetric key for all tokens in your project. Exposure would allow anyone to mint arbitrary identity tokens. Tokens are short-lived (300 seconds) and audience-bound to one project URL, so a leaked token cannot be replayed against a different project.