Skip to content

docs: add POST support for self-hosted JWT callback endpoint#3611

Merged
thesandlord merged 4 commits intomainfrom
devin/1770939125-jwt-callback-post-support
Feb 13, 2026
Merged

docs: add POST support for self-hosted JWT callback endpoint#3611
thesandlord merged 4 commits intomainfrom
devin/1770939125-jwt-callback-post-support

Conversation

@thesandlord
Copy link
Contributor

@thesandlord thesandlord commented Feb 12, 2026

docs: add POST support for self-hosted JWT callback endpoint

Summary

Updates the self-hosted authentication docs to reflect that the JWT callback endpoint (/api/fern-docs/auth/jwt/callback) now supports POST with application/x-www-form-urlencoded body, in addition to the existing GET query parameter flow. This documents the feature added in fern-platform#7059.

Changes:

  • Updated the "How it works" and "Building your login server" sections to describe both GET and POST methods
  • Wrapped the existing Node.js example in <Tabs> with a new POST tab showing an auto-submitting HTML form pattern
  • Added a changelog entry for 2026-02-12

Updates since last revision

  • Fixed grammar: "in a application/x-www-form-urlencoded" → "in an application/x-www-form-urlencoded" (line 45 of auth doc)

Review & Testing Checklist for Human

  • Verify the changelog link /learn/docs/self-hosted/authentication#basic-token-verification resolves to the correct page and anchor in the preview
  • Check <Tabs> rendering in the preview — confirm both GET and POST tabs display and switch correctly
  • XSS in POST example: The template literal injects redirectUri and token directly into HTML without escaping. Acceptable for a documentation example, but worth a conscious decision since users may copy-paste this into production code

Suggested test plan: Open the preview link, navigate to the self-hosted authentication page, and verify the tabbed code examples render correctly. Check the changelog page for the new entry.

Notes

  • Vale CI check passed
  • The POST tab duplicates the base64url/createFernJWT helper code from the GET tab to keep each example self-contained
  • Local testing confirmed all sections render correctly (tabs, changelog entry, formatting)

Link to Devin run | Requested by @thesandlord

Co-Authored-By: Sandeep Dinesh <sandeep@buildwithfern.com>
@devin-ai-integration
Copy link
Contributor

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Co-Authored-By: Sandeep Dinesh <sandeep@buildwithfern.com>
@@ -0,0 +1,5 @@
## POST support for self-hosted JWT callback

The self-hosted JWT callback endpoint (`/api/fern-docs/auth/jwt/callback`) now accepts `POST` requests with `application/x-www-form-urlencoded` body in addition to `GET` requests with query parameters. POST avoids exposing JWT tokens in URLs and server logs.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

remove "self-hosted", this callback endpoint works for all envs

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed "self-hosted" from both the changelog heading and body. Pushed in 133d641.

… envs

Co-Authored-By: Sandeep Dinesh <sandeep@buildwithfern.com>

The JWT callback endpoint (`/api/fern-docs/auth/jwt/callback`) now accepts `POST` requests with `application/x-www-form-urlencoded` body in addition to `GET` requests with query parameters. POST avoids exposing JWT tokens in URLs and server logs.

Learn more about [self-hosted authentication](/learn/docs/self-hosted/authentication#basic-token-verification).
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add a link to the auth overview page instead of self hosted specific page

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated to link to the auth overview page instead. Pushed in 19b6301.

Co-Authored-By: Sandeep Dinesh <sandeep@buildwithfern.com>
@thesandlord thesandlord merged commit bce8e52 into main Feb 13, 2026
2 checks passed
@thesandlord thesandlord deleted the devin/1770939125-jwt-callback-post-support branch February 13, 2026 00:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants