RenderContextDocumentation

Signing tokens

Sign short-lived viewer context tokens on your backend with the environment secretKey so RenderContext can trust verified attributes for flag targeting.

Prerequisites

Complete the quickstart and mint an environment secretKey (sk_live_…) in the console under Environments. Use the same key as @rendercontext/server.

1. Sign tokens on your backend

Prefer createClient(...).signViewerContext. Pass the token to the browser SDK with renderContext.setViewerContext({ attributes }, { token }) after sign-in or when attributes change.

import { createClient } from "@rendercontext/server";

const rc = createClient({
  publicKey: process.env.RC_PUBLIC_KEY!,
  secretKey: process.env.RC_SECRET_KEY!, // sk_live_…
});

// After real auth — return token to the browser
const token = await rc.signViewerContext({
  viewerId: user.id,
  attributes: {
    plan: user.plan,
    role: user.role,
  },
});

Tokens expire after the TTL (default 15 minutes). Keep RC_SECRET_KEY server-only.

2. Rotate when needed

Rotate the environment secret key in the console. The previous key remains valid for about 24 hours for both server auth and viewer-context tokens — update your backend during that window.

Related

Use verified attributes with feature flags targeting rules in the console.

Back to docs