SaaS Setup

The recipe this page builds: the widget is installed on your whole app, is invisible to everyone by default, and your own code decides, per user, who gets it. "This account should see feedback, enable it for them" becomes one if statement in your codebase.

1. Protect the project

In Project settings, Access, set widget visibility to require login. From this point, anonymous visitors never load the widget: not the UI, not even the script. Your other users notice nothing.

2. Enable the JS API

In Project settings, Developers: enable the JS API and copy the project secret into your backend environment as SC_PROJECT_SECRET.

3. Compute the hash at login

Wherever you build the signed-in page context (session endpoint, template globals, JWT claims), add the hash:

// Node/Express example: whatever you already use to expose session data
app.get("/api/session", (req, res) => {
  const user = req.user;
  res.json({
    // ...your existing session fields
    scUserHash: crypto
      .createHmac("sha256", process.env.SC_PROJECT_SECRET)
      .update(`${user.id}:${user.email}`)
      .digest("hex"),
  });
});

4. Boot for the users you choose

// After your auth state resolves:
if (session.plan === "enterprise" || session.flags.includes("feedback")) {
  SimpleCommenter("boot", {
    user: {
      email: session.email,
      name: session.name,
      externalId: session.userId,
    },
    userHash: session.scUserHash,
  });
}

The condition is yours: a feature flag, a plan check, an admin toggle, a beta cohort table. Simple Commenter does not need to know why; a user you boot can comment, a user you do not boot has no widget at all.

5. Clean up on logout

function onAppLogout() {
  SimpleCommenter("shutdown");
}

Optional touches

• Your own feedback button: hide the floating pill via widget settings and call SimpleCommenter("open") from a button in your product UI.
• Track engagement: SimpleCommenter("on", "comment:created", ...) into your analytics, so you can see which accounts actually use it.
• Roles: teammates whose email matches a workspace member automatically get their member role, so your own team sees internal statuses while customers see the reduced client view. See Clients.
• Pre-provisioning: if you would rather create clients ahead of time from your backend (or sync your whole user base), use the REST API. With the JS API alone, a verified identify creates the client automatically on first sight.