Configure authentication and privacy

How to get there: Click Settings in the sidebar → Authentication.

Authentication controls how users access your portal. Cookie consent, the privacy statement, and anonymization are on the separate Settings → Privacy page, also under People & access.

Choose which login methods are available on your portal:

ProductLift login -- the standard email-and-password login built into ProductLift.
Social authentication -- allow users to log in with Google, GitHub, or other social providers. Enable each provider individually.

Single Sign-On (SSO)

How to get there: Click Settings in the sidebar → Authentication tab → scroll to Single Sign-On (SSO).

Let users log in to your portal automatically from your own application. When SSO is configured, users who are already logged in to your app are seamlessly authenticated in ProductLift without a separate login step. See the SSO documentation for implementation details.

Turn SSO on or off

Use Allow members to sign in through your app in the Single Sign-On (SSO) section, then save. Turning it off stops members from signing in through your app, including in embedded widgets. It also hides your app's button from the ProductLift login page. Existing login sessions stay active; email/password, social login and Microsoft 365 remain separate settings.

SSO is on by default to preserve existing integrations. Turning it off hides the configuration fields but keeps your setup so you can enable it again later. Previously created sign-in links may work again when you turn SSO back on. Ask your developer to renew the secret if those links should stay invalid.

The SSO secret is masked by default. Use Show to reveal it or Copy to copy it without revealing it. Regenerate Secret creates a new key. Your developer must update your app or WordPress plugin afterwards. Existing sign-in links made with the old key stop working.

Choose how sign-ins are verified

Under Identity verification, choose:

Standard (JavaScript SDK) for a simple connection to your app. ProductLift accepts the user details your app provides without requiring a server-side identity check.
Verified (server-signed JWTs) when your app must confirm each user's identity. Recommended for private portals. Your developer or the WordPress plugin sets up this connection.

Click Save in the SSO section. With Verified selected, browser-only SDK identification is disabled. Your app can still sign members in using verified tokens. Portal administrators use their regular admin login.

When switching to Verified, older SDK tokens may work for up to one hour. For an immediate switch, save your choice, then ask your developer to regenerate the SSO secret and update your integration. People already signed in stay signed in. The SSO setup guide covers the technical details.

Turn on Show “Log in with your app” on the ProductLift login page, enter Your app's login URL and Button text, then save. Visitors can click this button to log in through your app and return to ProductLift. Leave it off if users already arrive signed in from your app.

Microsoft 365 / Entra ID SSO

How to get there: Click Settings in the sidebar → Authentication tab → scroll to Microsoft 365 / Entra ID SSO.

Let your team sign in with their existing Microsoft 365 work account. Login is tenant-restricted, so only members of your organization can sign in, and your existing MFA and conditional access policies in Entra ID apply automatically. See the Microsoft 365 / Entra ID SSO setup guide.

User Acceptance

When enabled, new sign-ups are held in a pending state until an admin approves them. You can also auto-approve users based on their email domain (e.g., approve everyone with an @yourcompany.com address).

Email Verification

Require users to verify their email address before they can post or vote. This helps prevent spam and fake accounts.

Private Portal

Make your portal visible only to logged-in users. Visitors who are not signed in will see a login page instead of your boards. This is useful for internal feedback portals or pre-launch communities.

Portal Password

Hide your entire portal behind a single shared password. Visitors are shown a password prompt before they can see any content; once they enter the correct password, a cookie lets them browse for 30 days without re-entering it. Admins are never prompted, they log in as usual.

Common use cases:

A knowledge base you host for one specific customer
A stealth-launch or beta portal shared with a small invite list
Any KB or roadmap you want reachable by URL but not indexable by search engines

How it works

Set a password in Settings → Authentication → Portal Password (minimum 4 characters).
Share the password with your audience via a private channel (email, DM, contract addendum).
Optional: share a bookmark link in the form https://your-portal.example/?k=YOUR_PASSWORD. The visitor lands, the password is verified, and they are redirected to the clean URL with the cookie set. The password is never left in the address bar after that first hop.

Notes

Setting a portal password automatically disables search-engine indexing for the portal. Google would otherwise cache the unprotected content on its first visit.
The password is stored hashed, so we cannot show it back to you. If you forget it, set a new one and reshare.
Rotating the password immediately invalidates every outstanding cookie. All visitors will be prompted again.
To remove the gate, use the "Clear password" button. The portal becomes publicly reachable again (subject to your other privacy settings).
Portal Password and Private Portal are independent. Enabling both means a visitor must first pass the shared-password gate, then log in with a personal account.

Maintenance Mode

Temporarily block all access to your portal. When enabled, visitors see a maintenance message instead of the portal. Admins can still access the portal normally.

Open Settings → Privacy.

Show a cookie consent banner to comply with GDPR and similar regulations. When enabled, a banner appears asking visitors to accept cookies before any tracking scripts are loaded.

Privacy Statement