Try setting a Tender.sso property. If you look at the widget page (Extra / Widgets in your site dashboard), there's a section for advanced configuration with a snippet like this:

<script type="text/javascript" charset="utf-8">
  Tender = {
    hideToggle: true,
    widgetToggles: [document.getElementById('help')]
  }
</script>

Add an sso property. Here's a quick ruby example:

  <script type="text/javascript" charset="utf-8">
    Tender = {
    <% if logged_in? -%>
      sso: "<%= escape_javascript(current_user.multipass) %>",
    <% end -%>
      hideToggle: true,
      widgetToggles: [$('help')]
    }
  </script>

I have multipass setup on my app as per the instructions, but when I have this in place, the widget returns a "Something has gone wrong" message from Tender.

A Lighthouse ticket was created for this discussion

Okay, I think I finally got this fixed. It looks like it was some weirdness with how the browser was handling the Tender session cookie from the other app page's iframe.

All my tests showed that yes, requests to http://URL?sso=TOKEN did in fact log the user in properly. But it doesn't matter if the browser does something totally different. It appears that the cookie sessions aren't persisted from request to request from the widget iframe. I'm not sure, but I'm now passing the SSO token around from page to page.

You'll want to make sure that the timeout you set when generating the SSO token is long enough. If you set it to just 5 minutes, the SSO won't log in if a user sits idle at a page for 10 minutes before attempting to send feedback through the widget.

Let me know if you have any other problems.

Hello. I have a question.
I can't autologin from widget. (from web page login is perfect. Use Cookies HMAC).
What I should do for autologin from widget?
Are you have any documentation for this?

Pass an SSO token as suggested above. This should log them in and sets any custom fields that you might want to use.