SapanBaseDevelopers

Identify logged-in users with HMAC

Securely identify logged-in users to the widget with an HMAC signature, so their chat history follows them across sessions and their contact record stays accurate.

If your site has logged-in users, identify them to the widget so their conversations tie back to a real contact rather than an anonymous visitor.

How identification works

Pass your user's identity to the widget along with an HMAC signature generated server-side using your widget secret key — never generate this signature in client-side code, since that would expose your secret. The server verifies the signature to confirm the identity claim is genuinely from your backend and not spoofed by the browser.

Why it matters for contacts

Identified users are recorded as verified contacts rather than leads (see Where contacts come from in the Help Center's Contacts category), and their signature anchors their identity consistently across sessions and devices.