Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Authenticate the user in your application, then have an authenticated backend endpoint mint a short-lived, vendor-specific JWT for the embedded editor. The browser may request that token, but it must never hold the signing secret or private key. Build the claims and choose the algorithm from the editor service’s current deployment guide: JWT profiles are not interchangeable.
The authentication flow
- Sign the user into your host application. Establish the session with your normal authentication system.
- Authorize editor access. Check that this user may use the requested editor, collaboration service, converter, or AI feature.
- Request a token from your backend. The editor’s provider calls an application endpoint that requires the existing authenticated session (or another verified identity mechanism). It must not be a public minting endpoint.
- Create and sign the JWT on the server. Add exactly the claims required by the chosen vendor and deployment, using its supported algorithm and key.
- Return the token to the editor. Some integrations expect a raw JWT; others expect an object such as
{"token":"..."}. - Send it to the vendor service. For converter APIs, this commonly means an
Authorization: Bearerheader. Follow the service-specific request format for other features.
A JWT is a signed, readable claims container. Anyone who receives it can decode its payload, so never put passwords, API secrets, private keys, or other confidential data in it.
Design the token endpoint
Authenticate before minting
Reuse the host application’s session, access token, or another verified identity mechanism. Resolve the current user server-side; do not accept an arbitrary sub value supplied by browser JavaScript. Then check entitlement for the particular service or feature. A user who can edit one document is not automatically authorized for every workspace or AI capability.
Keep keys server-side
For HMAC profiles, the shared secret stays exclusively in backend configuration or a secrets manager. Possession of that secret permits token forgery. For asymmetric profiles, keep the private key on the backend and configure only its matching public key with the vendor. Never ship either kind of signing material in the editor bundle.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Return a minimal response
Do not log complete tokens. Return only the shape the integration documents, set a non-cacheable response, and include a normal error status for unauthenticated or unauthorized users. A representative Express endpoint looks like this; replace the claim names, key handling, and algorithm with the target vendor’s profile.
import express from "express";
import jwt from "jsonwebtoken";
const app = express();
// Replace this with your session middleware.
function requireUser(req, res, next) {
const user = req.session?.user;
if (!user) return res.status(401).json({ error: "authentication_required" });
req.user = user;
next();
}
app.get("/api/editor-token", requireUser, (req, res) => {
if (!req.user.permissions?.includes("editor:use")) {
return res.status(403).json({ error: "editor_access_denied" });
}
const now = Math.floor(Date.now() / 1000);
const claims = {
aud: process.env.EDITOR_AUDIENCE,
sub: String(req.user.id),
iat: now,
// Include exp when required, or when you want a shorter lifetime.
exp: now + 15 * 60
};
const token = jwt.sign(claims, process.env.EDITOR_SECRET, {
algorithm: "HS256"
});
res.set("Cache-Control", "no-store");
res.json({ token });
});
app.listen(3000);The example uses HS256 only as a coding illustration. Do not infer that HS256 is correct for your service: TinyMCE hosted AI documents an asymmetric setup with RS-family or PS-family choices (RS256 is recommended there), while its on-premises AI guide specifies HS256. CKEditor Cloud Services documents HS256, HS384, and HS512 for its Cloud Services tokens.
Claims, lifetime, and clocks
Use the vendor’s exact claim profile
CKEditor Cloud Services documents aud, iat, and sub. The audience identifies the environment, the issued-at value lets the service assess age, and the subject identifies the user. An optional exp shortens validity; CKEditor documents acceptance of tokens no older than 24 hours.
TinyMCE AI hosted cloud documents aud, sub, iat, and exp, along with permission claims and a public/private-key arrangement. These requirements are not a drop-in replacement for CKEditor’s. Confirm whether your account uses hosted cloud or on-premises deployment before writing code.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
Choose a practical expiration
Use the shortest lifetime that does not disrupt normal editing, and implement the integration’s refresh callback when it has one. A long maximum acceptance window is not a reason to issue long-lived credentials. Never omit a required exp, and do not add an invented claim name because another vendor uses it.
Synchronize system time
iat and exp are NumericDate values (seconds since the Unix epoch in common JWT libraries). Clock drift between your application, containers, and the vendor can make a freshly issued token appear expired or issued in the future. Keep hosts synchronized and test with the clock configuration used in production.
CKEditor Cloud Services and Converters APIs
Cloud Services
Put the token endpoint in your application and return a token only after the user proves identity. Include the documented audience, subject, and issued-at claims, then add only the roles or permissions needed by the integration. CKEditor supports HS256, HS384, and HS512 for Cloud Services and documents a 24-hour maximum token age. Protect the corresponding secret.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Converters APIs
For the converters authentication path, generate the JWT on your backend and send it as a bearer token:
Rank #3
curl -X POST "https://your-converter-endpoint"
-H "Authorization: Bearer $EDITOR_JWT"
-H "Content-Type: application/json"
--data '{"html":"<p>Document</p>"}'The converter access key must not be exposed in browser code. Other Cloud Services requests can use a different documented authentication mechanism, so do not generalize this header to every CKEditor request.
TinyMCE AI token providers
Hosted cloud
TinyMCE AI obtains a backend-issued token through tinymceai_token_provider during initialization and periodically for refresh, typically every hour. The editor cannot become ready until its first token has been obtained. Your provider should call an authenticated endpoint and return the documented token response (or raw token, where that integration permits it).
tinymce.init({
selector: "#editor",
plugins: "ai",
tinymceai_token_provider: async (callback) => {
const response = await fetch("/api/editor-token", {
credentials: "same-origin",
headers: { "Accept": "application/json" }
});
if (!response.ok) throw new Error(`Token request failed: ${response.status}`);
const data = await response.json();
callback(data.token);
}
});Use the hosted cloud guide’s required claims and asymmetric key configuration. Do not copy the on-premises algorithm into a hosted deployment.
Recommended Free Tools
On-premises AI
The on-premises AI guide specifies HS256. That is a deployment-specific requirement; verify it against the exact service version and configuration you operate.
Client controls are not authorization
Hiding an AI button, removing a toolbar item, or checking a role in JavaScript improves usability but does not secure the service. An attacker can modify a client-side application and call your endpoints directly. Enforce identity, permissions, document access, and feature limits on server-controlled paths. Serve the application over HTTPS and follow the security guidance for HSTS.
Testing and failure handling
Test the endpoint independently
- Unauthenticated request returns 401 and never mints a token.
- Authenticated but unauthorized user returns 403.
- A valid token contains the exact audience, subject, timestamp units, permissions, and required expiration.
- Signature verification succeeds with the production-configured key and algorithm.
- Expired, altered, wrong-audience, and wrong-subject tokens are rejected.
Exercise the real editor
Load the editor in the target browser, capture the first token request, and verify that initialization completes. Then wait through the refresh interval, revoke access, and test behavior after expiry. Test the same flow behind your production proxy, with its cookie policy and authorization headers.
Common symptoms and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| 401 from token endpoint | Session cookie is absent or not accepted. | Use the correct credentials mode, cookie domain, Secure/SameSite settings, and CSRF protection. |
| 403 from token endpoint | User lacks the editor permission. | Check server-side entitlement and requested workspace/document. |
| Signature or algorithm error | Wrong deployment profile, key, or algorithm. | Confirm hosted versus on-premises configuration and match the vendor’s exact setting. |
| Token appears expired immediately | Milliseconds supplied where seconds are expected, or clock drift. | Use integer Unix seconds and synchronize system clocks. |
| Editor never becomes ready | Initial provider request failed, returned the wrong JSON shape, or was blocked by CORS. | Inspect the first network response, return the documented shape, and allow the authenticated origin. |
| Refresh fails after an hour | Refresh callback is missing, session expired, or endpoint rate-limited. | Implement the provider refresh path and return a newly signed token while the user remains authorized. |
Performance, reliability, and operations
- Keep token issuance stateless where practical, but perform the authorization lookup needed for each request.
- Do not cache token responses in a CDN or browser; use
Cache-Control: no-store. - Keep the endpoint close to the editor users and set a timeout that fails clearly rather than hanging editor startup.
- Monitor status codes and latency without recording JWT contents. Alert on spikes in rejected signatures, expired tokens, and provider failures.
- Rotate secrets or key pairs according to your vendor’s supported procedure. During asymmetric rotation, make the new public key available before issuing tokens that use its private counterpart.
- Document which claims, permissions, algorithm, and deployment each integration uses; this prevents a hosted/on-premises configuration mix-up.
Or skip the browser setup
If your next task is capturing the authenticated editor or its rendered output rather than building a browser harness, ScreenshotNeo provides a single-call screenshot API. It accepts cookies, custom headers, Authorization, a user agent, waits, JavaScript, and CSS, so you can reproduce an authenticated state without maintaining browser automation.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11For example, using the documented API pattern:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo documentation for the full option set. It removes cookie-consent banners, newsletter popups, and chat widgets before capture; bot checks, blank pages, failed loads, timeouts, and cache hits are not billed, and response headers identify the page verdict and billing status. Its MCP server exposes take_screenshot, get_page_info, and capture_pdf to Claude, Cursor, and other MCP clients. The free plan includes 1,000 screenshots per month without a card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
FAQ
Can the editor sign JWTs in the browser?
No. The browser can request and present a token, but signing keys and authorization decisions belong on your backend.
Best Value
Should every editor vendor use the same claims?
No. Claim names, required permissions, algorithms, key types, and expiration rules vary by vendor and deployment.
What should a token endpoint do when the user is logged out?
Return an authentication error and issue nothing. The editor should handle that failure instead of receiving a token with a guessed or anonymous identity.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Frequently Asked Questions
Can the editor sign JWTs in the browser?
No. The browser can request and present a token, but signing keys and authorization decisions belong on your backend.
Should every editor vendor use the same claims?
No. Claim names, required permissions, algorithms, key types, and expiration rules vary by vendor and deployment.
What should a token endpoint do when the user is logged out?
Return an authentication error and issue nothing. The editor should handle that failure instead of receiving a token with a guessed or anonymous identity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
