Django

Django endpoint example for signing Jupid Embed tokens.

Use PyJWT to sign a short-lived token from an authenticated Django view.

Install the signer in your Python environment:

python -m pip install PyJWT

Obtain your partner ID, shared secret, approved host origin, and Jupid app URL before testing. The browser must already be signed into your Django application.

Settings

In settings.py:

import os

JUPID_EMBED_PARTNER_ID = "your-partner-id"
JUPID_EMBED_AUDIENCE = "jupid-embed"
JUPID_EMBED_SECRET = os.environ["JUPID_EMBED_SECRET"]

Create views.py in the same Python package as your project's urls.py. The sample's user.profile.company_name is app-specific: replace build_jupid_payload with your agreed partner metadata. For HTTP synchronization, use business access for a business this user can access. Always Bank account snapshots use the separate snapshot contract.

Ensure the user's email is valid and get_full_name() returns a non-empty name; Jupid requires both claims.

import time
import uuid

import jwt
from django.conf import settings
from django.contrib.auth.decorators import login_required
from django.http import JsonResponse


def build_jupid_payload(user):
    return {
        "company_name": user.profile.company_name,
    }


@login_required
def jupid_embed_token(request):
    now = int(time.time())
    user = request.user
    payload = {
        "iss": settings.JUPID_EMBED_PARTNER_ID,
        "aud": settings.JUPID_EMBED_AUDIENCE,
        "sub": str(user.pk),
        "email": user.email,
        "name": user.get_full_name(),
        "payload": build_jupid_payload(user),
        "iat": now,
        "exp": now + 300,
        "jti": str(uuid.uuid4()),
    }
    token = jwt.encode(
        payload,
        settings.JUPID_EMBED_SECRET,
        algorithm="HS256",
        headers={"typ": "JWT"},
    )
    response = JsonResponse({"token": token})
    response["Cache-Control"] = "no-store"
    return response

from django.urls import path

from .views import jupid_embed_token

urlpatterns = [
    path("api/jupid/embed-token", jupid_embed_token, name="jupid_embed_token"),
]

An authenticated GET returns {"token":"..."} with caching disabled. login_required redirects signed-out visitors to your login page; complete that login before mounting the embed so the SDK receives JSON.

Frontend mount

Replace the partner ID and both staging URLs with the values issued by Jupid. Place this in the authenticated page's template:

<div id="jupid-embed" style="height: 100%; min-height: 720px"></div>
<script src="https://jupid-staging-app.example.com/embed.js"></script>
<script>
  function openJupid() {
    JupidEmbed.mount({
      partnerId: "your-partner-id",
      tokenUrl: "/api/jupid/embed-token",
      container: document.getElementById("jupid-embed"),
      initialPath: "/",
      appUrl: "https://jupid-staging-app.example.com",
    })
  }

  openJupid()
</script>

The iframe should open the user's Jupid workspace. See Browser SDK for destination overrides, the single HTTP 401 refresh, and cleanup if your frontend removes the embed without a full-page navigation.

Security checklist

Protect the token endpoint with normal Django authentication.
Keep JUPID_EMBED_SECRET server-only.
Use the durable user primary key for sub.
Send the same sub every time for the same partner user.
Keep token expiration short.

Django

Settings

Token endpoint

Frontend mount

Security checklist

On this page