Identify signed-in customers

Without identification, the widget treats each browser as an anonymous visitor. When you pass who the customer is, conversations follow them across devices and your team sees their name and email beside every chat.

To stop one customer pretending to be another, the identity is signed on your server with a secret only you hold.

1. Generate your identity secret

1. Open Settings, Messenger, Install.
2. In Identify signed-in customers, select Generate secret.
3. Copy the secret straight away. It is shown only once.

Keep it on your server. Never put it in browser code. You can Rotate secret at any time, but hashes made with the old secret stop working immediately, so deploy the new secret first.

2. Sign the customer id on your server

The hash is the HMAC-SHA256 of the customer id, written as lowercase hex.

// Node.js
import { createHmac } from 'node:crypto';

const hash = createHmac('sha256', process.env.TIRVER_IDENTITY_SECRET)
  .update(String(user.id))
  .digest('hex');

# Python
import hashlib, hmac, os

user_hash = hmac.new(
    os.environ["TIRVER_IDENTITY_SECRET"].encode(),
    str(user.id).encode(),
    hashlib.sha256,
).hexdigest()

3. Pass it to the widget

Set the details before the script loads, or call Tirver.identify after sign-in.

<script>
  window.tirverSettings = {
    widget_id: 'YOUR_WIDGET_ID',
    user_id: '42',
    user_hash: 'HASH_FROM_YOUR_SERVER',
    email: 'ada@example.com',
    name: 'Ada'
  };
</script>
<script async src="https://app.tirver.com/tirver.js"></script>

// after the customer signs in
Tirver.identify({ user_id: user.id, user_hash: hashFromServer, email: user.email, name: user.name });

When the customer signs out, call Tirver.shutdown() so the next person on that browser starts fresh.

Require a valid hash

Turn on Require a valid hash before showing past conversations. The switch is available once a secret exists. With it on, a customer whose hash does not match sees no history. Turn it on as soon as every page that loads the widget passes a hash.