Skip to content

Member integration

How to link members of your service to KiTbetter accounts.

How it works — token handoff (SSO)

The partner issues a signed JWT containing the member's information and redirects the user to a KiTbetter landing page. KiTbetter takes it from there — it verifies the token, collects the member's consent to the terms, and completes the integration.

Partners implement only two things

① Issue a token · ② Redirect. There is no API for the partner to call directly. This flow is separate from the data APIs (authenticated with the X-API-Key header).

Before you start — onboarding

You receive the following two items before starting the integration. Request them through the contact channel and we will walk you through onboarding.

Item Purpose
JWT signing secret Signing tokens with HS256 (issued per partner)
Landing URL The partner-specific address to redirect users to

Test environment details are provided during onboarding as well.

① Issue a token — JWT format

The payload (claim) specification for the token the partner issues.

Claim Requirement Description Example
iss Required Issuer (identifies the partner) your-service.com
sub Required The member's unique ID in the partner system partner-member-0001
email Required Member email user@your-service.com
exp Required Expiration time (Unix epoch seconds) 1778582468
name Recommended Member display name Jane Doe
iat / nbf Recommended Issued-at / not-before time (Unix epoch seconds) 1778578868
accountName Optional Partner account name TestAccountName
aud Optional Audience (recipient) identifier
  • Signing algorithm: HS256 (shared secret).
  • Keep token lifetimes short with exp to prevent reuse and leakage.
  • Store the secret somewhere safe such as a server environment variable, and never embed it in client-side code.

② Redirect

Append the token you issued as a jwt parameter to the landing URL you received during onboarding, and send the user there.

https://kitbetter.com/partners/accept-terms?jwt={TOKEN}

KiTbetter handles everything after the redirect, and the integration completes once the member accepts the terms.