May 23, 2024 - Your authentication server can now check the value of this field, and handle it accordingly: ... app.get('/', (req, res) => { const customerInfo = req.query.space === 'customer-a' ? CUSTOMER_A : CUSTOMER_B; const token = jwt.sign({}, customerInfo.jwtSigningKey, { expiresIn: '1h' }); const redirectURL = `${customerInfo.url}/${req.query.location || ''}?jwt_token=${token}`; res.redirect(redirectURL); }); Visitor Authentication works well with custom domains.

December 5, 2025 - If your GitBook documentation requires authentication (e.g., visitor authentication via OIDC, Auth0, or a custom backend), the embed cannot access your docs content unless the user's authentication token is provided.

Used to authenticate and authorize AzureAD users to GitBook Spaces with the Visitor Authenticator Feature. User enters GitBook documentation site. GitBook redirects to this service via the "Fallback URL".

Once enabled, you can set up your custom backend that creates and signs a JSON Web Token (JWT) upon successful authentication and redirects users back to GitBook. Find out more about setting up a custom authentication backend in our docs.

April 10, 2025 - Validate user credentials and authenticate them. Generate and sign a JSON Web Token (JWT) upon successful authentication.

It allows to define the secret key used to sign the token so that GitBook can verify the validity of JWT tokens. ... Go to your Clerk dashboard. In your Clerk application, go to JWT templates.

This repository is a small example of an application implementing the GitBook "Visitor authentication". ... yarn GITBOOK_URL=https://mycompany.gitbook.io/myspace/ GITBOOK_JWT_KEY=<key from your repository> node ./server.js

February 1, 2024 - Set up custom authentication for your published content.

This repository is a small example of an application implementing the GitBook "Visitor authentication". ... yarn GITBOOK_URL=https://mycompany.gitbook.io/myspace/ GITBOOK_JWT_KEY=<key from your repository> node ./server.js

December 17, 2025 - Back in GitBook, enable the toggle labeled Include claims in JWT token, then click Save. Finally, head to the Audience tab in your site settings. Under Access, choose Authenticated Access, and select Auth0 from the dropdown.

JSON Web Token (JWT) Authentication JWT · Update Public Key JWT · Proof of Possession (PoP) Proof of PossessionPowered by GitBook · On this page · For the complete documentation index, see llms.txt. This page is also available as Markdown. CopyOn this page ·

March 20, 2025 - You can view and manage your access tokens in the Developer settings of your GitBook user account. API requests are authenticated using the Bearer Auth scheme.

March 25, 2025 - So, entering the least permissive scope is the best security recommendation. ... Now, in GitBook, close the integrations modal and click on the Manage site button. Navigate to Audience, select Visitor Authentication, and choose OIDC as the backend.

API key should send in the ... :JWT Tokens are actually a full JSON Object that has been base64 encoded and then signed with either a symmetric shared key or using a public/private key pair....

April 23, 2026 - Authenticated access allows you to publish your content while requiring authentication from any visitors who want to view it.

December 17, 2025 - In order to pass data securely through a cookie, you’ll need to send the data as a JSON Web Token from your application in a cookie named gitbook-visitor-token tied to your domain.

You can view and manage your access tokens in the Developer settings of your GitBook user account. API requests are authenticated using the Bearer Auth scheme.

So in your case, providing your book is private (private GitHub repo), an access key is a solution, but you cannot easily control the set of people using it; ie: you can only control the set you are giving the token to. So that means you have to provide your own front-end, with user account management, in order to give access to the book. But GitBook itself does not have such mechanism.