Integrating Duda into a SaaS platform (2/3)

August 21, 2024
0 minute read

In the first part of this series, we discussed how to generate content-rich websites that are fully populated with data produced by the day-to-day usage of your application. Now that we've covered the initial creation of websites, let's turn our attention to the experience of your users as they navigate between the Duda website builder and your own user interface.


The first step in creating a seamless experience for your customers is to white label the editor's UI and URL, along with the URLs of the sites you build.


White labeling the editor


Before we discuss the actual process of authenticating your users into the Duda website builder, let's take a look at how we can present a branded user interface (UI) as they edit their sites. Duda is the website builder you can call your own, and one of the big reasons for that is our extensive white-labeling capabilities. With the customization options available, you are able to rebrand the editor as an extension of your own product. To get started, log into your account and select “White Label” in the top menu and click “Custom Branding” in the dropdown.



Duda's dashboard, with a mouse hovering over the


When undertaking an integration between Duda and a SaaS platform, the most important white label features to configure are the ones that control how the site editor looks. While options are available for rebranding other components of Duda such as the login screen and dashboard, it's more likely than not that these aspects will be fully controlled by the source application, rather than Duda. We'll cover how we can skip the login screen and, instead, pre-authenticate the user a bit later on. 


To customize the website editor’s branding, switch to the “Editor" tab within the white label page. From here, you'll be able to upload your own logo and customize the colors of text and buttons. For advanced branding work, you can also include your own custom CSS and HTML. As you save your work, you'll be able to see a preview generated of the changes.



White labeling the editor’s URL


Once you have the interface branding in place, there is one important additional step; the domain name your users will see in the browser. By default the Duda site editor URL is going to be some derivative of a generic Duda domain, such as “x.responsivewebsite.com.” 


It's possible to update this to something more branded such as “editor.mydomain.com” or “mydomaineditor.com” by navigating to “White Label” → “Custom Domain” and then selecting the “Dashboard Domain” tab. Keep in mind that you will need to add a CNAME entry to the DNS of whatever domain you choose. The value for this entry is provided on the custom domain page.



White labeling client sites URLs


After the actual website editing experience is branded, we need to think about the publishing experience. Taking a site live is where the entire process comes to a screeching halt for many agencies and SaaS companies. Domain names and DNS can be a complex subject for non-technical people. Many users might not have a domain, or they may have an existing site that is already using their domain. They may even have registered a domain, or had someone register it for them, and never actually set up a website for it.


Regardless of their situation, it can turn into a long process to get these users to update their DNS so it points to their newly created site. To make the publishing process as simple as possible, Duda allows any site in your account to be instantly published under a subdomain of a domain of your choosing. For example, client “1” might end up with a URL like “client1.sites.mydomain.com” or “client1.mydomainsites.com.” Setting up the site’s domain provides a frictionless way to take a site live without having to tie up the user with the intricacies of DNS and domain management.


Once a site is live, it's a perfect time to provide some light-touch support to aid the user in the transfer or registration of a domain. Duda provides unbranded support articles to help your users through the process. In addition, the create site and update site API endpoints allow you to update the domain or subdomain of a site directly from your own application as well, so you can guide your users through the process from your own UI.


With all the options available, you'll be able to ensure your users can go from creation to a published site in record time.



Authenticating users into Duda


With our branding all configured, we're ready to transfer users from your SaaS application to the Duda site editor. To make this process completely seamless, we need to add a couple more API calls to the process we started in the first part of this series. In that post, we discussed making a call to create the website, and another to push data from the SaaS platform into the content library of the new site. Once those calls have been successfully completed, we will make additional calls to create a Duda user account, and then allow that user to access the site.


"Create User" API call


The create user API call allows you to pass the actual user identifier to Duda, and this means you can use the same user ID you use in your own application as the account_name property in the API payload. By matching the IDs, it simplifies future API calls that require user identification, such as our SSO endpoint or granting a user access to a site. Additionally, you should specify an account_type of CUSTOMER in the request body, to distinguish this user from your staff accounts. The body can also contain user metadata such as name and email address.


API call

 

curl --request POST \ 

--url https://api.duda.co/api/accounts/create \ 

--header 'authorization: Basic123abc=' \ 

--header 'content-type: application/json' \ 

--data '{"account_type":"CUSTOMER","account_name":"<unique_user_id>","first_name":"John","last_name":"Doe","email":"john@example.org","lang":"en"}'


Note: API calls require an API username and password to authenticate.


Because you are choosing the user identifier in the call, we will not return it after success. Instead, you will receive a 204 status code with no data in the response body. It's also important to point out that you don't specify or receive any type of password for these users. As we'll see later in this post, we expect any users created via API to authenticate directly from your application through our SSO endpoint instead of navigating to a login page.


"Grant Site Access" API call


At this point in the process, we have successfully created a user in Duda, but they have yet to receive permission to edit a site. The grant site access call will rectify that. With this call, we can specify not only a site to which this user should be given access, but also a list of permissions for that site. Using these permissions, we can provide an extremely simple editing experience, or one that is more complicated but immensely flexible for the user.


API call

 

curl --request POST \ 

--url https://api.duda.co/api/accounts/<unique_user_id>/sites/<site_name>/permissions \

--header 'authorization: Basic123abc=' \ 

--header 'content-type: application/json' \ 

--data '{"permissions":["LIMITED_EDITING","PUBLISH","REPUBLISH"]}'


In this example, we are giving the user access to a specific website by using both the user ID we chose in the previous step, and the site_name we received from our create website API call. By passing in permissions for LIMITED_EDITING, PUBLISH and REPUBLISH, the user will be presented with a very simple editor that only allows them to change existing content. They will not be able to add or delete widgets and content, or add or remove additional pages. A full listing of permissions can be retrieved from the list client permissions API endpoint. Using permissions, it's possible to give different users varying degrees of access to the same site.


Sending users to the editor


With these additional API calls, we have all the pieces we need to allow a user to edit their site. The last step is utilizing the SSO API endpoint to move the user from your SaaS application to the white-labeled editor. 


Within your application's UI, we'll need some sort of "Edit Website" button that appears after a site has been created for the logged in user or organization. This button, when clicked, will issue the call to the SSO endpoint, utilizing the same user identifier you chose in the create user step. The API response will include an editor URL to which you can immediately redirect the browser. 


It's important this call is made at the time of intent — you don't want to make the call to the SSO endpoint on application load and cache the return URL for a long period. The URLs are only valid for a maximum of two minutes for security reasons. It's best to make the call when the user has actually interacted with the button.


In addition to the site name and user ID. You will need to supply a target query parameter. This allows you to deep-link into the Duda application to areas such as the template picker, stats page, or dashboard. In the case of SaaS integrations, you almost always want to send the user directly to the site editor, so we provide a value of EDITOR.


API call

 

curl --request POST \ 

--url --url 'https://api.duda.co/api/accounts/sso/<unique_user_id>/link?site_name=<site_name>&target=EDITOR'

 \

--header 'authorization: Basic123abc='


Below is an example response:


API response

 

{  

"url":"http://example.mobilewebsiteserver.com/home/site/<site_name>?dm_sso=abcde12345"

}



Summing up


So far in this series, we've seen how to programmatically create websites and populate them with content from a SaaS platform. We've also learned how to create users with access to these newly created sites. With Duda's white labeling capabilities, these users will see a fully branded experience, completely unaware they've ever left the source application.



In the final post of this series, we'll talk about the integration of more complex data structures, and automatically generating or removing entire pages of content from a site when a user changes data in your platform. Until then, try creating a few client users either by API or within the Duda application. Change their permission settings to narrow in on the type of experience that would work best for your users.



Jason

Jason Hummel

Director of Solution Engineering, Duda

With over 25 years of web development experience, Jason is focused on providing elegant, usable solutions that follow current industry standards.


Did you find this article interesting?


Thanks for the feedback!
By Shawn Davis April 1, 2026
Core Web Vitals aren't new, Google introduced them in 2020 and made them a ranking factor in 2021. But the questions keep coming, because the metrics keep changing and the stakes keep rising. Reddit's SEO communities were still debating their impact as recently as January 2026, and for good reason: most agencies still don't have a clear, repeatable way to measure, diagnose, and fix them for clients. This guide cuts through the noise. Here's what Core Web Vitals actually measure, what good scores look like today, and how to improve them—without needing a dedicated performance engineer on every project. What Core Web Vitals measure Google evaluates three user experience signals to determine whether a page feels fast, stable, and responsive: Largest Contentful Paint (LCP) measures how long it takes for the biggest visible element on a page — usually a hero image or headline — to load. Google considers anything under 2.5 seconds good. Above 4 seconds is poor. Interaction to Next Paint (INP) replaced First Input Delay (FID) in March 2024. Where FID measures the delay before a user's first click is registered, INP tracks the full responsiveness of every interaction across the page session. A good INP score is under 200 milliseconds. Cumulative Layout Shift (CLS) measures visual stability — how much page elements unexpectedly move while content loads. A score below 0.1 is good. Higher scores signal that images, ads, or embeds are pushing content around after load, which frustrates users and tanks conversions. These three metrics are a subset of Google's broader Page Experience signals, which also include HTTPS, safe browsing, and mobile usability. Core Web Vitals are the ones you can most directly control and improve. Why your clients' scores may still be poor Core Web Vitals scores vary dramatically by platform, hosting, and how a site was built. Some of the most common culprits agencies encounter: Heavy above-the-fold content . A homepage with an autoplay video, a full-width image slider, and a chat widget loading simultaneously will fail LCP every time. The browser has to resolve all of those resources before it can paint the largest element. Unstable image dimensions . When an image loads without defined width and height attributes, the browser doesn't reserve space for it. It renders the surrounding text, then jumps it down when the image appears. That jump is CLS. Third-party scripts blocking the main thread . Analytics pixels, ad tags, and live chat tools run on the browser's main thread. When they stack up, every click and tap has to wait in line — driving INP scores up. A single slow third-party script can push an otherwise clean site into "needs improvement" territory. Too many web fonts . Each font family and weight is a separate network request. A page loading four font files before rendering any text will fail LCP, especially on mobile connections. Unoptimized images . JPEGs and PNGs served at full resolution, without compression or modern formats like WebP or AVIF, add unnecessary weight to every page load. How to measure them accurately There are two types of Core Web Vitals data you should be looking at for every client: Lab data comes from tools like Google PageSpeed Insights, Lighthouse, and WebPageTest. It simulates page loads in controlled conditions. Lab data is useful for diagnosing specific issues and testing fixes before you deploy them. Field data (also called Real User Monitoring, or RUM) comes from actual users visiting the site. Google collects this through the Chrome User Experience Report (CrUX) and surfaces it in Search Console and PageSpeed Insights. Field data is what Google actually uses as a ranking signal — and it often looks worse than lab data because it reflects real-world device and connection variability. If your client's site has enough traffic, you'll see field data in Search Console under Core Web Vitals. This is your baseline. Lab data helps you understand why the scores are what they are. For clients with low traffic who don't have enough field data to appear in CrUX, you'll be working primarily with lab scores. Set that expectation early so clients understand that improvements may not immediately show up in Search Console. Practical fixes that move the needle Fix LCP: get the hero image loading first The single most effective LCP improvement is adding fetchpriority="high" to the hero image tag. This tells the browser to prioritize that resource over everything else. If you're using a background CSS image for the hero, switch it to anelement — background images aren't discoverable by the browser's preload scanner. Also check whether your hosting serves images through a CDN with caching. Edge delivery dramatically reduces the time-to-first-byte, which feeds directly into LCP. Fix CLS: define dimensions for every media element Every image, video, and ad slot on the page needs explicit width and height attributes in the HTML. If you're using responsive CSS, you can still define the aspect ratio with aspect-ratio in CSS while leaving the actual size fluid. The key is giving the browser enough information to reserve space before the asset loads. Avoid inserting content above existing content after page load. This is common with cookie banners, sticky headers that change height, and dynamically loaded ad units. If you need to show these, anchor them to fixed positions so they don't push content around. Fix INP: reduce what's competing for the main thread Audit third-party scripts and defer or remove anything that isn't essential. Tools like WebPageTest's waterfall view or Chrome DevTools Performance panel show you exactly which scripts are blocking the main thread and for how long. Load chat widgets, analytics, and ad tags asynchronously and after the page's critical path has resolved. For most clients, moving non-essential scripts to load after the DOMContentLoaded event is a meaningful INP improvement with no visible impact on the user experience. For websites with heavy JavaScript — particularly those built on frameworks with large client-side bundles — consider breaking up long tasks into smaller chunks using the browser's Scheduler API or simply splitting components so the main thread isn't locked for more than 50 milliseconds at a stretch. What platforms handle automatically One of the practical advantages of building on a platform optimized for performance is that many of these fixes are applied by default. Duda, for example, automatically serves WebP images, lazy loads below-the-fold content, minifies CSS, and uses efficient cache policies for static assets. As of May 2025, 82% of sites built on Duda pass all three Core Web Vitals metrics — the highest recorded pass rate among major website platforms. That baseline matters when you're managing dozens or hundreds of client sites. It means you're starting each project close to or at a passing score, rather than diagnosing and patching a broken foundation. How much do Core Web Vitals actually affect rankings? Honestly, they're a tiebreaker — not a primary signal. Google has been clear that content quality and relevance still dominate ranking decisions. A well-optimized site with thin, irrelevant content won't outrank a content-rich competitor just because its CLS is 0.05. What Core Web Vitals do affect is the user experience that supports those rankings. Pages with poor LCP scores have measurably higher bounce rates. Sites with high CLS lose users mid-session. Those behavioral signals — time on page, return visits, conversions — are things search engines can observe and incorporate. The practical argument for fixing Core Web Vitals isn't just "because Google said so." It's that faster, more stable pages convert better. Every second of LCP improvement can reduce bounce rates by 15–20% depending on the industry and device mix. For client sites that monetize through leads or eCommerce, that's a revenue argument, not just an SEO argument. A repeatable process for agencies Audit every new site before launch. Run PageSpeed Insights and record LCP, INP, and CLS scores for both mobile and desktop. Flag anything in the "needs improvement" or "poor" range before the client sees the live site. Check Search Console monthly for existing clients. The Core Web Vitals report surfaces issues as they appear in field data. Catching a regression early — before it compounds — is significantly easier than explaining a traffic drop after the fact. Document what you've improved. Clients rarely see Core Web Vitals scores on their own. A monthly one-page performance summary showing before/after scores builds credibility and makes your technical work visible. Prioritize mobile. Google uses mobile-first indexing, and field data shows that mobile CWV scores are almost always worse than desktop. If you only have time to optimize one version, do mobile first. Core Web Vitals aren't a one-time fix. Platforms change, new scripts get added, campaigns bring in new widgets. Build the audit into your workflow and treat it like any other ongoing deliverable, and you'll stay ahead of the issues before they affect your clients' rankings. Duda's platform is built with Core Web Vitals performance in mind. Explore how it handles image optimization, script management, and site speed automatically — so your team spends less time debugging and more time building.
By Ilana Brudo March 31, 2026
Vertical SaaS must transition from tools to an AI-powered Vertical Operating System (vOS). Learn to leverage context, end tech sprawl, and maximize retention.
By Shawn Davis March 27, 2026
Automate client management, instant site generation, and data synchronization with an API-driven website builder to create a scalable growth engine for your SaaS platform.
Show More

Latest posts