Who is signed in. Read the visitor's email, name and role from the headers Hub adds.

Hub signs a visitor in before the request reaches a private or org app, then adds three headers:

Values that are not plain ASCII arrive percent-encoded, so decode them: a name like Wörk arrives as W%C3%B6rk.

const email = decodeURIComponent(req.headers['x-hub-email'] ?? '');
const name = decodeURIComponent(req.headers['x-hub-name'] ?? '');
const role = req.headers['x-hub-role'];

Hub removes any of these headers a visitor sends, and your app is reachable only through Hub, so the values come from Hub. Run the same image somewhere else and they mean nothing.

Roles in your app

Hub decides who may open the app. What each person may do inside it is up to the app. Hub checks nothing there.

• Take rights away only when the header is there. A viewer might get a read-only view, and a guest should get what your app gives people outside your org, never what it gives a member.
• Read a missing X-Hub-Role as "Hub did not say". Apps on older hosts receive only the email and the name. Treat that visitor as an ordinary member, and never grant extra rights on a missing header.
• Never refuse a sign-in because the role is missing.

When you change someone's role or remove them from your org, Hub signs in again everyone who has your org's apps open, on their next request and with no form, so the app sees the new role right away.

Public apps

A public app receives none of the three headers.