Outpost Community Demo

Embed SSO: token exchange returns 401 intermittently

By jmpk ·

We're using embed SSO to auto-login users from our Next.js app. It works ~95% of the time, but about 1 in 20 attempts fails with a 401 on the token exchange endpoint.

Our flow

  1. User loads page with embedded Outpost
  2. Our API route calls POST /api/community/:slug/embed/sso/token with the user's email
  3. We pass the returned token to the embed via data-sso-token
  4. Embed exchanges token → sometimes 401

I think it might be a race condition — if the embed script loads and tries to exchange the token before our API has fully returned it, the token might not be valid yet?

Anyone else hitting this?

4 replies

danthedev ·

I had a similar issue! In our case it was a timing problem with React hydration. The embed script was reading the data-sso-token attribute before React had updated the DOM with the actual token value.

Fix was to not render the embed div until we actually had the token:

{ssoToken && (
  <div id="outpost-embed" data-sso-token={ssoToken} />
)}

That brought us to 100% success rate.

jmpk ·

That was exactly it! I was rendering the div immediately and setting the token attribute after the API call resolved. The embed script was racing against the state update. Conditional render fixed it. Thanks Daniel!

priya.sh ·

Maybe the docs should mention this pattern? The current embed SSO docs show the token as a static attribute, which works for server-rendered pages but not for SPAs where the token is fetched client-side.

top-outpost-ninja ·

Great callout. I've updated the embed SSO docs to include both the server-rendered and SPA patterns. The SPA section now explicitly shows the conditional render approach. Thanks for surfacing this!