> For the complete documentation index, see [llms.txt](https://docs.growsurf.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.growsurf.com/getting-started/participant-auto-authentication.md).
# Participant Auto Authentication
If your program is configured to have participants log in, you can set up Participant Auto Authentication to automatically log participants into their browser.
## **Set up the client**
**Step 1:** Require participants to log in within the Program Editor
**Step 2:** Generate a new *Participant Auth Secret*
**Step 3:** Copy your unique *Participant Auth Secret* (to use for later in the [Setting up the server](#set-up-the-server) instructions).
{% hint style="info" %}
Keep your *Participant Auth Secret* private. Do not put it in GitHub, Bitbucket, or client code.
{% endhint %}
**Step 4:** Go to the final instructions page within the Program Editor to copy the new GrowSurf Universal Code.
Adding a *Participant Auth Secret* changes the snippet, so reinstall the new [GrowSurf Universal Code](/getting-started.md#step-1-install-the-growsurf-universal-code-onto-your-site).
This new GrowSurf Universal Code snippet contains a new `window.grsfConfig` Object. Remember to replace two values: (1) set `email` as the participant's email address, and (2) set `hash` as the value you receive from [setting up the server](#set-up-the-server). See the example code block below:
```markup
```
{% hint style="info" %}
Showing your program in more than one language? Add `language` to the same `window.grsfConfig` object, such as `language: "es"`. See [Example 8](https://docs.growsurf.com/developer-tools/javascript-sdk/tutorials#example-8-show-your-program-in-more-than-one-language).
{% endhint %}
## Set up the server
On your server, you will need to create a *Hash-based message authentication code* (HMAC).
**Step 1:** Implement SHA-256 HMAC, passing in the following values:
* The *Participant Auth Secret (*from Step 3 of the [Setting up the client](#set-up-the-client) section)
* The participant's email address
Below is an example of the HMAC implementation in Node.js:
{% tabs %}
{% tab title="Node.js" %}
```javascript
require("crypto")
.createHmac("sha256", "")
.update("participant@email.com")
.digest("hex");
```
{% endtab %}
{% endtabs %}
## Authorize affiliate Join
For an affiliate program that reviews applications, Participant Auto Authentication proves identity but does not bypass review. GrowSurf shows the normal Apply experience when the authenticated person is not already an approved affiliate.
To let a specific signed-in user join directly, create the SHA-256 HMAC from the exact email followed by `:AFFILIATE_JOIN`:
```javascript
require("crypto")
.createHmac("sha256", "")
.update("participant@email.com:AFFILIATE_JOIN")
.digest("hex");
```
Then include the optional `affiliateJoin` field with the same email and scoped hash:
```javascript
window.grsfConfig = {
email: "participant@email.com",
hash: "AFFILIATE_JOIN_SCOPED_HMAC",
affiliateJoin: true
};
```
GrowSurf shows a Join confirmation and records the participant's acceptance of the current program terms. A pending, denied, suspended, or banned state cannot be bypassed. Omit `affiliateJoin` and continue signing the email alone for ordinary Participant Auto Authentication.
## **Testing**
To test, load a page where GrowSurf is installed. If it works, you are signed in as a participant.
Related references:
* JavaScript SDK method [`growsurf.init()`](https://docs.growsurf.com/developer-tools/javascript-sdk/api-reference#initialize-reinitialize-growsurf)
* [Single Page Applications](https://docs.growsurf.com/developer-tools/javascript-sdk/single-page-applications)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.growsurf.com/getting-started/participant-auto-authentication.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.