Authentication
How people sign in to the dashboard, how the widget authenticates on your site, and how guests leave feedback without an account.
Annot8 uses Clerk for dashboard identity, and a separate short-lived, origin-validated session for the widget running on your site.
Signing in to the dashboard
Three ways in:
- Email code — enter your address and Annot8 emails you a one-time code. There is no password to set, forget, or leak.
- GitHub
All three land on the same account, so you can start with a code and later use Google without creating a duplicate.
Annot8 does not use passwords for dashboard sign-in. If a page or email asks you for an Annot8 password, it did not come from us — forward it to security@annot8.app.
How the widget authenticates
The widget UI runs in a sandboxed iframe served from the Annot8 origin, which means it can't read your page's cookies and your page can't read its session.
Team members
If you're already signed in to the dashboard in that browser, the widget picks up your session and your comments are attributed to your account. If not, the widget opens a sign-in popup; once you finish, the widget picks up straight where you were.
Popup blockers are the usual reason this appears to hang — the popup is opened in response to your click, so allowing popups for your own site resolves it.
Guests
Anyone can leave feedback without an account through a public link. They give a name (and optionally an email) with their first comment, and the thread is attributed to that name.
Guest reviewers never consume a paid seat. The Free plan allows 3 distinct guest reviewers per workspace; every paid plan makes them unlimited.
Origin validation
Before any public write is accepted, the widget calls Annot8 with your project
key. Annot8 checks the browser-sent Origin header against the project's
environment patterns and, if it matches, issues a short-lived session token.
Writes without a valid token are rejected.
This is why a stolen script tag doesn't work on someone else's domain: the project key alone isn't enough, the request has to arrive from a hostname you authorised.
Roles
Roles are set per workspace. See Team members for the full permission matrix.
| Owner | Admin | Member | |
|---|---|---|---|
| View projects and threads | Yes | Yes | Yes |
| Comment, resolve threads | Yes | Yes | Yes |
| Create / edit / delete projects | Yes | Yes | No |
| Manage integrations | Yes | Yes | View only |
| Invite and remove members | Yes | Yes | No |
| Change someone's role | Yes | No | No |
| Manage billing | Yes | Yes | No |
| Delete the workspace | Yes | No | No |
Guests who comment through a public link have no dashboard access at all.
SAML / OIDC SSO
Single sign-on is part of the Business and Enterprise plans. It isn't self-serve — we configure it with your identity provider during onboarding. Email sales@annot8.app to start.
There is no public REST API yet
Annot8 does not currently expose a public REST API or issue API keys, and the
pj_... project key is a public identifier for the widget rather than a secret
credential. To move data out of Annot8 today, use:
- Outbound webhooks — a JSON POST on every new thread, which is what you want for Zapier, Make, or n8n
- Export CSV from the project inbox
- Download your data in Account & privacy for a personal export
Trouble signing in
- The code email never arrives. Check spam, then confirm you typed the same address you signed up with. Codes are single-use and short-lived — request a fresh one rather than reusing an old email.
- The widget's sign-in popup does nothing. Allow popups for your site.
- You're signed in but see no projects. You're probably in the wrong workspace. Switch it from the selector at the top of the sidebar.