Use secure identification to verify a signed-in customer's email before the widget shows their support conversations.

Plan access: Support Suite is available on Scale and Enterprise, during an active trial, or when enabled separately for the workspace.

Enable secure identification

  1. Open Settings → Channels → Email.
  2. Find Chat identification and enable Secure user identification.
  3. Copy the Authentication secret into your server's secret storage.

Keep the secret on your server. The browser receives the customer's email and its generated hash, never the secret.

Generate the email hash on your server

Normalize the email by trimming surrounding whitespace and converting it to lowercase. Generate a SHA-256 HMAC and encode it as hexadecimal:

import { createHmac } from "node:crypto";

const email = user.email.trim().toLowerCase();
const emailHash = createHmac(
  "sha256",
  process.env.USERORBIT_CHAT_SECRET,
).update(email).digest("hex");
JavaScript

Use the email from your authenticated server session rather than trusting an email supplied by an unauthenticated browser.

Pass the email and hash to the widget

Pass both values at the root of the initialization configuration:

await userorbit.init({
  accountId: "YOUR_ACCOUNT_ID",
  email,
  emailHash,
});
JavaScript

Test with an account you control and confirm the widget shows the correct customer's conversations.

For unknown visitors, initialize with requireAuthentication: true to ask them to verify by email.

Replace a secret

Use Re-generate secret if the existing secret has been exposed. Regeneration immediately invalidates existing email hashes. Update the server secret and generate fresh hashes before identifying more users.

Was this helpful?