Let your site recognize AiPlatformers subscribers

How the flow works

1. A subscriber clicks Launch on AiPlatformers. We verify their subscription on our servers.
2. We redirect them to your tool's URL with ?pf_token=<JWT> appended — a token signed with your secret key, valid for 5 minutes.
3. Your site verifies the token, reads the subscriber's email, and starts its own session (create an account for them on the fly if they don't have one).
4. On later visits they log into your site as usual; your server re-checks the entitlement API so canceled subscribers lose access.

1. Verify the launch pass

The token is a standard JWT (HS256) signed with your secret key. Verify it with any JWT library — for example with jose in Node:

import { jwtVerify } from "jose";

const secret = new TextEncoder().encode(process.env.AIPLATFORMERS_SECRET);

// e.g. in the route handling https://your-tool.com/?pf_token=...
const { payload } = await jwtVerify(pfToken, secret, {
  issuer: "aiplatformers",
  audience: "your-maker-slug",   // your storefront slug
});

// payload = {
//   sub:      "user id on AiPlatformers",
//   email:    "[email protected]",  // verified subscriber
//   name:     "Their name",
//   maker_id: "...", tool_id: "...",
//   exp:      <5 minutes after launch>
// }
logThemIn(payload.email);

If verification fails or the token is expired, treat the visitor as a regular (unauthenticated) visitor. Never accept the token client side only — verify it on your server.

2. Re-check entitlements any time

The launch pass proves the subscription at launch time. For ongoing access (your own login flow, a daily check), ask our API from your server:

curl "https://platformers-beryl.vercel.app/api/v1/[email protected]" \
  -H "Authorization: Bearer $AIPLATFORMERS_SECRET"

// → { "active": true, "status": "active",
//     "email": "[email protected]", "checked_at": "..." }

status is one of active, past_due, canceled, or none. A sensible policy: allow on active, warn on past_due, block otherwise. Cache results for a few hours — the limit is 300 checks per 5 minutes.

3. Combine with your own customers

Selling directly on your site too? Keep your own auth exactly as it is and treat AiPlatformers as one more way a user can be entitled:

const hasAccess =
  user.hasMyOwnSubscription ||        // your direct customers
  (await aiplatformersActive(user.email)); // our subscribers

Match users by email. A visitor arriving with a valid launch pass who already has an account on your site is simply logged into it.

Security notes

• Your secret key stays on your server — never in browser code or a public repo. Regenerate it in the studio if it leaks (the old key stops working immediately).
• The launch pass expires after 5 minutes and is single-purpose: use it to start your own session, don't store it.
• Integration is optional — without it, your tool link is still only revealed to subscribers on AiPlatformers, but your site itself stays public. Integrating is what makes your site enforce the subscription.