How to integrate Identity Management with commenting apps

You can easily initiate user authentication before allowing users to comment by calling tp.pianoId.isUserValid(). This call returns a boolean and gives you the opportunity to check whether a user is logged in or not, as well as the capability to create conditionals around commenting privileges.

If you want to restrict access to commenting only to users that have a particular level of access or are subscribers, you can also leverage existing methods to check access.

To retrieve the user info on the client side - use tp.pianoId.getUser(). If you need to validate the identity of the user - you can use tp.pianoId.getToken(), and validate the JWT signature of the token with the JWT verification shared secret that can be found in the Identity Management settings page in the publisher dashboard.

Important note: The JWT verification shared secret is Base64url encoded and needs to be decoded before using it to verify the JWT token.

In JavaScript, you can decode it as follows:

// Decode a Base64url-encoded secret to a byte array
function decodeBase64url(base64url) {
  const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
  const raw = atob(base64);
  return Uint8Array.from(raw, c => c.charCodeAt(0));
}

A Python sample code for decoding the JWT verification shared secret can be found below:

import jwt
import base64
jwt.decode(token, base64.b64decode(secret), algorithms="HS256", audience="<Piano_AID>")

Based on the user access validation or user state, you can then show or hide commenting as appropriate.

Last updated: August 03, 2026