DEMO: in production your backend mints this token with the tenant secret it holds — desktower never mints end-user tokens. This page stands in for that backend for dev/demo only.
Help & Support
Signed in to Acme as cust-aliceAC

Help & Support

Open a support ticket below. The support panel is the embedded desktower widget — Acme never stores your tickets or writes the answers.

DEMO — view as end-user: cust-alice cust-bob (each sees only their own tickets)

Embedded via <iframe src="/widget?token=…&pk=…">. Acme's backend minted a short-lived token for cust-alice and paired it with the non-secret publicKey; the widget presents them to the desktower API.

iframe · desktower widget · authenticated as cust-alice

How this works in production: the integrator's own backend holds the per-tenant widget secret and mints the end-user token (HS256 over {tenant, sub, exp, iat}) when it renders the page for a signed-in end-user. desktower only verifies that token (via the publicKey → tenant/secret lookup) and JIT-provisions the end-user — it never mints end-user tokens. This /demo/host page uses the demo tenant's seeded widget key to stand in for that backend, for dev/demo only.