May 23, 2024 - Your authentication server can now check the value of this field, and handle it accordingly: ... app.get('/', (req, res) => { const customerInfo = req.query.space === 'customer-a' ? CUSTOMER_A : CUSTOMER_B; const token = jwt.sign({}, customerInfo.jwtSigningKey, { expiresIn: '1h' }); const redirectURL = `${customerInfo.url}/${req.query.location || ''}?jwt_token=${token}`; res.redirect(redirectURL); }); Visitor Authentication works well with custom domains.

December 5, 2025 - If your GitBook documentation requires authentication (e.g., visitor authentication via OIDC, Auth0, or a custom backend), the embed cannot access your docs content unless the user's authentication token is provided.

Used to authenticate and authorize AzureAD users to GitBook Spaces with the Visitor Authenticator Feature. User enters GitBook documentation site. GitBook redirects to this service via the "Fallback URL".

April 10, 2025 - Validate user credentials and authenticate them. Generate and sign a JSON Web Token (JWT) upon successful authentication.

Once enabled, you can set up your custom backend that creates and signs a JSON Web Token (JWT) upon successful authentication and redirects users back to GitBook. Find out more about setting up a custom authentication backend in our docs.

Once you've created the key, you need to include it as the value of a query parameter named jwt_token the URL of the GitBook content you wish the user to have access to (see redirectURL) Here's a very simple Express application for signing keys and redirecting users: ... Finally, within link and domain settings in the visibility menu, you can configure a fallback URL. When someone directly accesses your space without the necessary token, GitBook uses the fallback URL to redirect the visitor to a custom URL so that you can authenticate them.

It allows to define the secret key used to sign the token so that GitBook can verify the validity of JWT tokens. ... Go to your Clerk dashboard. In your Clerk application, go to JWT templates.

This repository is a small example of an application implementing the GitBook "Visitor authentication". ... yarn GITBOOK_URL=https://mycompany.gitbook.io/myspace/ GITBOOK_JWT_KEY=<key from your repository> node ./server.js

This repository is a small example of an application implementing the GitBook "Visitor authentication". ... yarn GITBOOK_URL=https://mycompany.gitbook.io/myspace/ GITBOOK_JWT_KEY=<key from your repository> node ./server.js

February 1, 2024 - Set up custom authentication for your published content.

December 17, 2025 - Back in GitBook, enable the toggle labeled Include claims in JWT token, then click Save. Finally, head to the Audience tab in your site settings. Under Access, choose Authenticated Access, and select Auth0 from the dropdown.

You only get this message if you're authenticated"} // get the *jwt.Token which contains user information using: // user := myJwtMiddleware.Get(ctx) or context.Get("jwt").(*jwt.Token) ctx.JSON(iris.StatusOK, response) }

JSON Web Token (JWT) Authentication JWT · Update Public Key JWT · Proof of Possession (PoP) Proof of PossessionPowered by GitBook · On this page · For the complete documentation index, see llms.txt. This page is also available as Markdown. CopyOn this page ·

March 20, 2025 - You can view and manage your access tokens in the Developer settings of your GitBook user account. API requests are authenticated using the Bearer Auth scheme.

March 25, 2025 - So, entering the least permissive scope is the best security recommendation. ... Now, in GitBook, close the integrations modal and click on the Manage site button. Navigate to Audience, select Visitor Authentication, and choose OIDC as the backend.

API key should send in the ... :JWT Tokens are actually a full JSON Object that has been base64 encoded and then signed with either a symmetric shared key or using a public/private key pair....

December 17, 2025 - In order to pass data securely through a cookie, you’ll need to send the data as a JSON Web Token from your application in a cookie named gitbook-visitor-token tied to your domain.

April 23, 2026 - Authenticated access allows you to publish your content while requiring authentication from any visitors who want to view it.