Helpdesk form duplicates users

Hi Nathanael Spriet! This behavior is by design. If an unauthenticated user fills the form with an email address belonging to an existing user, a temporary reporter account is created to represent the ticket author. Such tickets are also marked with the unauthenticated reporter badge. Once the email owner replies to the conversation from that address, the ticket ownership is verified — user accounts get automatically merged, and the ticket becomes authored by the standard user account with this email address.

Hi Stanislav Dublin!

Thanks for this reply. As I explain in previous messages in this forum, I'm trying to develop a custom issue form embedded in our website. You explained to me here that there is no official REST API to create a ticket and the best way to do this would be to mimic an online form submission. That's what I did, and now I have this issue with users: when our customers submit a new issue through our embedded form, it works well because they are only “reporters” in YouTrack. But we designed our form to be used also internally, so when an employee, who already has a YouTrack account, uses our form, this creates a duplicate, as I explained before.

I understand how and why you did this.

In your opinion, what would be the best solution for our case?

Thanks!

It seems that you would need to have the form check if the user account with this email already exists in YouTrack. If it does and it's not a reporter-type user, you'll want to avoid duplicating accounts. Some form of authorization will be needed to achieve that. I see two approaches depending on your setup.

The first is to add OAuth authentication to your form. YouTrack supports OAuth 2.0 authorization for client-side web apps. If an employee authenticates before submitting, you could get the request to carry over their session and get the ticket created under their existing account.

The second is to have your backend make a REST API call authorized as a project agent (likely via a permanent token). In this case, the agent creates the ticket on behalf of the employee — the employee doesn't need to authenticate themselves, and the token stays on the backend. To mimic the API call of an agent creating a ticket on behalf of a standard user, you can again check the Network tab when submitting a ticket on behalf of a standard user in the UI.

That said, the simplest approach is ignoring the duplicate accounts, as normally this is resolved through auto-merge when the user replies from their email or uses the login link in the submission confirmation. I understand this may not work for you, but I thought it's worth mentioning it again, just in case.

Hi Stanislav!

(Sorry for the late reply, I was unavailable for the last week)

Thanks for your detailed reply! Your second option - making an API call as a project agent - sound interesting and the go-to solution. Unfortunately, that's what I previously did, which led to my issue explained here.

I'll try your first option, carrying over the user session.

It's a bit unfortunate that what seems to be a “simple” task (submitting a ticket through REST API) is so complicated.

Are there any planned developments that could simplify this?

Thanks again.

Hi Nathanael! Thanks for getting back to us.

Unfortunately, that's what I previously did, which led to my issue explained here.

Are there any planned developments that could simplify this?

I may be missing something, but in the reply you referenced, the problem was that a ticket created with a POST to /api/issues wouldn't send a notification to the reporter. We have a relevant improvement recorded here—feel free to vote for it: JT-86113.

However, my suggestion was rather to use the online form API by mimicking the agent's submission of the online form on behalf of a specific user. In that case, the ticket should be created with the correct form (i.e., a channel registered in the project settings), which should produce the necessary notification.