floors.js Documentation

payload = base64url(JSON({ uid, name, exp: nowMs + 3600000 }))
sig     = base64url( HMAC_SHA256(payload, WIDGET_SECRET) )
token   = payload + "." + sig

// app/lib/floors.ts
import crypto from "crypto";
const b64url = (b) => Buffer.from(b).toString("base64url");

export function floorsToken(user) {
  const payload = b64url(JSON.stringify({
    uid: user.id, name: user.name, exp: Date.now() + 3600_000,
  }));
  const sig = crypto.createHmac("sha256", process.env.FLOORS_WIDGET_SECRET)
    .update(payload).digest("base64url");
  return payload + "." + sig;
}

// app/(app)/layout.tsx — server component
import { floorsToken } from "@/app/lib/floors";
import { getSession } from "@/app/lib/auth"; // your auth

export default async function AppLayout({ children }) {
  const session = await getSession();
  const token = session ? floorsToken(session.user) : null;
  return (
    <>
      {children}
      <script
        src="https://floorsjs.com/embed/floors.min.js"
        data-key="flr_..."
        {...(token ? { "data-user-token": token } : {})}
        async
      />
    </>
  );
}

// pages/api/floors-token.ts — returns a token for the logged-in user
import crypto from "crypto";
import { getSession } from "@/lib/auth";
const b64url = (b) => Buffer.from(b).toString("base64url");

export default async function handler(req, res) {
  const session = await getSession(req);
  if (!session) return res.status(401).end();
  const payload = b64url(JSON.stringify({
    uid: session.user.id, name: session.user.name, exp: Date.now() + 3600_000,
  }));
  const sig = crypto.createHmac("sha256", process.env.FLOORS_WIDGET_SECRET)
    .update(payload).digest("base64url");
  res.json({ token: payload + "." + sig });
}

// client, after login:
const { token } = await fetch("/api/floors-token").then(r => r.json());
window.Floors?.identify(token);

import crypto from "crypto";
const b64url = (b) => Buffer.from(b).toString("base64url");
const SECRET = process.env.FLOORS_WIDGET_SECRET;

app.get("/app", (req, res) => {
  let tag = '<script src="https://floorsjs.com/embed/floors.min.js" data-key="flr_..." async></scr'+'ipt>';
  if (req.user) {
    const payload = b64url(JSON.stringify({
      uid: req.user.id, name: req.user.name, exp: Date.now() + 3600_000,
    }));
    const sig = crypto.createHmac("sha256", SECRET).update(payload).digest("base64url");
    const token = payload + "." + sig;
    tag = '<script src="https://floorsjs.com/embed/floors.min.js" data-key="flr_..." data-user-token="' + token + '" async></scr'+'ipt>';
  }
  res.send(renderPage({ floorsTag: tag }));
});

function floors_token($user) {
  $secret  = env('FLOORS_WIDGET_SECRET');
  $payload = rtrim(strtr(base64_encode(json_encode([
    'uid' => $user->id, 'name' => $user->name,
    'exp' => (int)(microtime(true) * 1000) + 3600000,
  ])), '+/', '-_'), '=');
  $sig = rtrim(strtr(base64_encode(
    hash_hmac('sha256', $payload, $secret, true)
  ), '+/', '-_'), '=');
  return $payload . '.' . $sig;
}

// Blade (logged-in only):
// @auth <script src="https://floorsjs.com/embed/floors.min.js"
//   data-key="flr_..." data-user-token="{{ floors_token(auth()->user()) }}"></script> @endauth

import os, json, time, hmac, hashlib, base64

def b64url(b: bytes) -> str:
    return base64.urlsafe_b64encode(b).rstrip(b"=").decode()

def floors_token(user) -> str:
    secret = os.environ["FLOORS_WIDGET_SECRET"].encode()
    payload = b64url(json.dumps({
        "uid": str(user.id), "name": user.name,
        "exp": int(time.time() * 1000) + 3_600_000,
    }).encode())
    sig = b64url(hmac.new(secret, payload.encode(), hashlib.sha256).digest())
    return f"{payload}.{sig}"

# template context: token = floors_token(request.user) if request.user.is_authenticated else None

require "openssl"; require "base64"; require "json"

def floors_token(user)
  secret  = ENV["FLOORS_WIDGET_SECRET"]
  payload = Base64.urlsafe_encode64(
    { uid: user.id, name: user.name, exp: (Time.now.to_f * 1000).to_i + 3_600_000 }.to_json,
    padding: false
  )
  sig = Base64.urlsafe_encode64(
    OpenSSL::HMAC.digest("SHA256", secret, payload), padding: false
  )
  "#{payload}.#{sig}"
end

# erb (logged-in only):
# <% if user_signed_in? %><script src="https://floorsjs.com/embed/floors.min.js"
#   data-key="flr_..." data-user-token="<%= floors_token(current_user) %>"></script><% end %>