Member data in your custom code (and a token Make, n8n or Zapier can trust)

Show a signed-in member their own name, company or settings on your Super site, and let your automation know who is calling it - without putting a secret into your custom code. You pick the columns of your Notion members table; Super gives the signed-in member's own row to your custom code as window.superMember, and seals the columns you choose into a token only your automation can check. We built this for a customer whose client portal saves each client's settings back to Notion through Make.

member signs in → Super reads their own row in your Notion members table
   → window.superMember = { loggedIn, tiers, name, company, token }
   → your custom code shows the readable columns and sends token to your webhook
   → Make / n8n / Zapier checks token with your site key → knows the member → writes to Notion

Why

• Personalise members-only pages: "Welcome back, Anna", the member's company logo, their plan.
• Stop putting webhook secrets into custom code. Anything in custom code is visible to every visitor; a token made by Super for one member, for a short time, is not a secret you have to hide.
• Your automation gets a fact it can trust: this request comes from the member with this Client ID, signed in on your site, within the last hour.

Before you start

• A Super site on the Pro plan with Super Memberships connected.
• Custom code on the site (Pro includes it).
• For the token: an n8n, Make or Zapier account.

Set it up

1. Site → Settings → Membership → Expose member data → Configure.
2. Expose member data: on. Off keeps your choices for later.
3. Available on:
• Members-only pages (default) - only pages protected by Membership get the member's data. Public pages get null.
• Whole site - every page, public ones too, while a member is signed in.
4. Tick Expose for each column your custom code may read. Your tier column is always there as tiers (tier names).
5. Tick Encrypt for columns that must not be readable in the browser, or that your automation must be able to trust (an ID, an email). They go into token instead.
6. With an encrypted column, choose the Method and Token expires after (15 minutes, 1 hour or 24 hours), then Save. Super creates your site key on the first save.
7. Copy the key and paste it into your automation. The key stays on Super's server and is never sent to a browser.

The preview in the popup shows exactly what your custom code gets.

What your custom code gets

window.superMember = {
  loggedIn: true,
  tiers: ["Client"],
  name: "Anna Clarke",
  company: "Acme Ltd",
  token: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…"  // client_id + expiry
}

• A signed-in member only ever gets their own row, never anyone else's.
• Nobody signed in, or a page outside the chosen scope: window.superMember is null.
• Keys come from your column names: Client ID → client_id. The popup shows each key.
• Values: text as text, numbers, checkboxes, multi-select as a list of names, dates as { start, end }, files as [{ name, url }] (Notion file links expire after an hour).

The data arrives after the page loads, so wait for it:

<script>
window.superMemberReady.then(function (member) {
  if (!member) return; // nobody signed in
  document.querySelectorAll("[data-member-name]").forEach(function (el) {
    el.textContent = member.name;
  });
});
// or: window.addEventListener("super:member", function (e) { console.log(e.detail); });
</script>

Send the token to your automation

const member = await window.superMemberReady;
await fetch("https://hook.eu1.make.com/your-hook", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ token: member.token, logoUrl: newLogoUrl }),
});

No secret in this code: the token is the proof, and it expires.

Check the token in your automation

The token carries:

{
  "iss": "super.so",
  "site": "yoursite.com",
  "iat": 1793690233,
  "exp": 1793693833,
  "member": { "client_id": "C-0142" }
}

Accept a request only when the token checks out with your key, exp is in the future and site is your domain. Then use member - for example to find the member's row in Notion.

const crypto = require("crypto");
const [h, p, s] = token.split(".");
const ok = crypto.createHmac("sha256", KEY).update(h + "." + p).digest("base64url") === s;
const claims = JSON.parse(Buffer.from(p, "base64url").toString());
if (!ok || claims.exp * 1000 < Date.now() || claims.site !== "yoursite.com") throw new Error("rejected");

Keep it safe

• Never paste the key into custom code - it belongs only in your automation.
• Generate new key ends every token made with the old one: update your automation right after.
• Choose the shortest expiry that works for your pages; a copied token works until it expires.
• Columns you don't tick never leave Super.

When the data changes

Super reads the member's row when they sign in and keeps it for up to 24 hours. Reload tiers or saving the Expose member data settings refreshes it for everyone at once. The token itself is made fresh on every page view.

For AI agents

With the Super MCP connected (https://mcp.super.so/mcp), your assistant can set all of this up and build on it. Describe what you want in your own words; this is what it works with.

Tools

Typical flow

1. get_member_data - see the columns and what is already exposed.
2. set_member_data - expose the columns the page needs; encrypt the ones a webhook must trust (an ID, an email).
3. get_member_data again - read the final keys (they come from the column names, for example Client ID → client_id).
4. patch_code - custom code that awaits window.superMemberReady, fills the page from the readable keys and sends token to the webhook.
5. Build the automation in n8n, Make or Zapier with the token check above: signature or decryption with the site key, exp in the future, site equal to the site's domain, then use member.

What an agent cannot do

• Read or create the site key. The owner copies it in the dashboard (Settings → Membership → Expose member data → Copy) and pastes it into the automation. It must never end up in custom code or in a chat log.
• Turn it on below the Pro plan; the tools answer that the feature is not in the site's plan.
• Expose the tier column as a column: it is always there as tiers (names).
• See a member's data from the owner's preview: preview_site is not a member session, so window.superMember is null there. To check the real result, sign in as a test member - see Test members-only pages with an AI agent.

Facts worth keeping in mind

• The data only reaches pages in the chosen scope; elsewhere window.superMember is null, never missing - code can always await window.superMemberReady.
• Member rows are cached for up to 24 hours; saving with set_member_data or reload_membership_tiers refreshes them.
• A new token is made on every page view, with the chosen expiry.
• There is no MCP tool for a new key on purpose: a new key breaks the owner's automation until they paste it in, so only the owner does that, in the dashboard.