Verify logged-in visitors

Tell the web messenger who a signed-in visitor is, with a signature only your server can make.

4 min read

If visitors sign in to your website, you can tell the web messenger who they are. Your team then sees their name and email, the same person is recognised on every device, and they see their past conversations.

To stop anyone from pretending to be someone else, your server signs each visitor’s user id with a secret key. Prativani accepts the visitor only when the signature matches.

Before you start

Every planNeeds: Widget keys: Write

The web messenger is installed on your website. See Install the web messenger on your website.
A developer who can change your website’s server code.

1. Create a secret key

Go to SettingsChannelsWeb Messenger and open the Widget keys tab.
On the key your website uses, click Identity verification.
Click Generate secret key.
Click Copy key and store the secret with your server’s other secrets, such as in an environment variable.

The secret is shown only once. When you close the window, it can’t be shown again.

You should see Identity verification is configured.

Each widget key has its own secret. If your websites use different keys, set up each one.

2. Sign the user id on your server

When a visitor is signed in, your server makes a signature from their user id:

Use the user id that never changes for that person, such as their account number. Don’t use an email address, which they can change.
The signature is HMAC-SHA256. The key is the secret turned from hex into bytes, the message is the user id as text, and the result is written as lowercase hex.
Sign exactly the text you send as user_id. An extra space or a change of case gives a different signature.

const crypto = require('crypto');

function userHash(userId, secretHex) {
  return crypto
    .createHmac('sha256', Buffer.from(secretHex, 'hex'))
    .update(String(userId))
    .digest('hex');
}

const signature = userHash(user.id, process.env.PRATIVANI_IDENTITY_SECRET);

import hashlib
import hmac
import os

def user_hash(user_id: str, secret_hex: str) -> str:
    return hmac.new(
        key=bytes.fromhex(secret_hex),
        msg=user_id.encode('utf-8'),
        digestmod=hashlib.sha256,
    ).hexdigest()

signature = user_hash(str(user.id), os.environ['PRATIVANI_IDENTITY_SECRET'])

<?php
function userHash($userId, $secretHex) {
    return hash_hmac('sha256', (string) $userId, hex2bin($secretHex));
}

$signature = userHash($user->id, getenv('PRATIVANI_IDENTITY_SECRET'));

require 'openssl'

def user_hash(user_id, secret_hex)
  OpenSSL::HMAC.hexdigest('sha256', [secret_hex].pack('H*'), user_id.to_s)
end

signature = user_hash(user.id, ENV['PRATIVANI_IDENTITY_SECRET'])

3. Send it to the web messenger

Change the install code on your pages so it keeps the web messenger in a variable, then call identify with the user id and the signature from your server:

<script src="https://cdn.prativani.com/widget.js"></script>
<script>
  const widget = new SupportWidget({ widgetKey: 'nd_xxxxxxxx' });

  widget.identify({
    user_id: '42',
    user_hash: 'SIGNATURE_FROM_YOUR_SERVER',
    name: 'Alex Smith',
    email: '[email protected]',
  });
</script>

name, email and phone are optional. Any other details you add, such as plan: 'gold', are saved on the contact.

When the visitor signs out of your website, call widget.reset(). This clears their identity and chat from that browser, so the next person using it starts fresh.

Check it works

If the details don’t appear, open your key’s Identity verification window and look under Recent verification failures:

Invalid signature: the signature doesn’t match. Check that you sign the same user_id you send, decode the secret from hex, and send lowercase hex.
No signature provided: user_hash is missing.

A visitor whose signature fails can still chat. They’re treated as an anonymous visitor.

If the secret leaks

Open the key’s Identity verification window, click Rotate key and confirm. The old secret stops working at once, so put the new one on your server straight away. Until you do, visitors are treated as anonymous.

To turn identity verification off, click Delete key in the same window and confirm. This deletes only the secret, not the widget key.