Prerequisites
- A React 18 or 19 application.
- A publishable key for your workspace (
pk_live_…orpk_test_…) and a JWT secret — generate both in your workspace’s API keys section (see Publishable Keys & Secrets). - A backend that can sign a short-lived JWT with that secret. The secret must never reach the browser.
1. Install
2. Supply a session token
Every SDK request carries a short-lived HS256 bearer token. The SDK never mints it — it calls yourgetToken callback and sends whatever you return. How you produce it depends on where the SDK is running.
In your own app: your backend signs it
Sign a short-lived JWT with your JWT secret on your server, and expose an endpoint your frontend can call. Statisfy requires the standardiat / exp claims plus the end user’s email, which is how the gateway resolves who is asking.
In a Statisfy Portal: exchange at /sdk/auth
A hosted portal has no backend of its own, so it exchanges the signed-in user’s identity (your tenant’s Clerk/IdP JWT) for a Statisfy session token:
customer_id. If the email isn’t a customer, /sdk/auth returns 403 not_a_customer.
Either way the token is short-lived (the exchange defaults to 1 hour, see
expires_in). Cache it and re-mint before it expires — getToken (next step) is the natural place to do that.3. Wrap your app in StatisfyProvider
StatisfyProvider supplies the gateway URL and authentication to every SDK component via React context. Set it up once, high in your tree:
4. Render your first component
Now any SDK component works anywhere beneath the provider — no connection props needed.5. Theming (optional)
The SDK’s styles are self-contained and prefixed (dw:) so they won’t collide with your app’s CSS. Override the look with --dw-* CSS variables on any ancestor of the SDK components:
Troubleshooting
401 user_token_invalid
401 user_token_invalid
The bearer token’s signature didn’t verify. Make sure
getToken returns the session token from /sdk/auth (not the raw Clerk JWT), that it hasn’t expired, and that you minted it against the same tenant/environment your gateway points at.403 not_a_customer
403 not_a_customer
The signed-in user’s email isn’t a person on any account in your tenant. Add them as a contact, or sign in as a known customer.
Components throw 'must be rendered inside <StatisfyProvider>'
Components throw 'must be rendered inside <StatisfyProvider>'
An SDK component is mounted outside the provider. Move it beneath
<StatisfyProvider>.