Part 4: Dynamic Provisioning

Add a Premium Plan

We will first create a new Premium Plan that we will provision dynamically, which includes the "Widget" Feature with the "Enabled" property set to unlimited access.

1. Navigate to the Plans page in the MonetizationOS console
2. Click "Add Plan"
3. Give it a name, e.g. "Premium"
4. Click "Create"

You'll notice that we're leaving automatic plan assignments off for this Plan, as we will be assigning it dynamically in a workflow. Now let's configure the Premium Plan to include the "Widget" Feature, with "Enabled" and "Premium" set to On (true).

1. Navigate to the Configure Features tab
2. Click "Configure Features"
3. Select the "Widget" Feature
4. Toggle the "Enabled" property to On (true)
5. Toggle the "Premium" property to On (true)
6. Click "Update Plan"

Add a JWT Integration

Next, we will add a JWT Integration to our MonetizationOS organization to allow us to use JWT tokens for user identification.

1. Navigate to the Integrations page in the MonetizationOS console
2. Click "Add an Authentication Method"
3. Give it a name, e.g. "Test JWT"
4. Copy a Public Key (RS256) from your JWT generation tool (e.g. token.dev) and paste it into the "JWT Public Key" field
5. Enter a JWT Claim Key of email
6. Click "Save JWT and Continue"

Make a JWT Surface decision

To make a JWT Surface decision update the previous cURL command, replacing userIdentifier with userJwt.

You will need to generate a JWT token for the request. Here is an example token payload you can use in your JWT generation tool:

{
    "sub": "1234567890",
    "name": "John Doe",
    "email": "test@example.com",
    "premium": true,
    "iat": 1760714314
}

Make sure to replace $JWT_TOKEN in the cURL command with your generated JWT token:

curl -X POST https://api.monetizationos.com/api/v1/surface-decisions \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d '{
  "surfaceSlug": "$SURFACE_SLUG",
  "identity": {
    "userJwt": "$JWT_TOKEN"
  }
}'

You should receive a response with changes similar to the following:

{
    ...
    "identity": {
        "authType": "provided", 
        "authType": "jwt", 
        "identifier": "test@example.com",
        "isAuthenticated": true,
        "jwtClaims": {} 
        "jwtClaims": { 
            "sub": "1234567890",
            "name": "John Doe",
            "email": "test@example.com",
            "premium": true,
            "iat": 1760714314
        }
    },
    ...
}

We're now successfully identifying the same user as Part 3 (e.g. "test@example.com") via JWT token.

Add a Dynamic Provisioning workflow

We will now add a Provisioning workflow to dynamically assign the Premium Plan based on the premium claim in a JWT token.

How to add a Dynamic Provisioning Workflow:

1. Go to the Plans page in the MonetizationOS console
2. Click on the Provisioning Workflows tab
3. Click on the "Add Provisioning Workflow" button
4. Give it a name, e.g. "Premium Provisioning"
5. Click "Create Workflow"

Replace the default code with the following, and click "Update Workflow" to save your changes:

const workflow: ProvisioningWorkflow = async ({ identity }) => {
    // Assign premium if provided in JWT claims
    return identity.jwtClaims.premium ? ["premium"] : [];
};

export default workflow;

Make a JWT Surface decision again

Rerun the JWT Surface decision request again to confirm your provisioning workflow is working as expected.

You should receive a response with changes similar to the following:

{
    ...
        "enabled": {
            "counterId": "default:feat_abcd1234.enabled",
            "type": "meterable",
            "hasAccess": false, 
            "consumedUnits": 3,
            "remainingUnits": 0,
            "totalUnits": 3,
            "uniqueResources": false,
            "resourceIdUsed": false,
            "periodStart": "Thu, 01 Jan 1970 00:00:00 GMT",
            "hasAccess": true, 
            "isFallback": false
        }
    ...
    "surfaceBehavior": {
        "properties": {
            "userMessage": "Hello, test+9@example.com",
            "isAuthenticated": true,
            "widgetAccess": false, 
            "premiumWidgets": false,
            "remainingWidgets": 0,
            "widgetAccess": true, 
            "premiumWidgets": true
        }
    },
    ...
}

As you can see, your user now has access to the Premium Plan features based on the premium claim in the JWT token.