# Identify signed-in customers

> Tell the widget who is signed in, with a hash from your server, so nobody can read another customer's conversations.

Without identification, the widget treats each browser as an anonymous visitor. When you pass who the customer is, conversations follow them across devices and your team sees their name and email beside every chat.

To stop one customer pretending to be another, the identity is signed on your server with a secret only you hold.

## 1. Generate your identity secret

1. Open **Settings, Messenger, Install**.
2. In **Identify signed-in customers**, select **Generate secret**.
3. Copy the secret straight away. It is shown only once.

Keep it on your server. Never put it in browser code. You can **Rotate secret** at any time, but hashes made with the old secret stop working immediately, so deploy the new secret first.

## 2. Sign the customer id on your server

The hash is the HMAC-SHA256 of the customer id, written as lowercase hex.

```js
// Node.js
import { createHmac } from 'node:crypto';

const hash = createHmac('sha256', process.env.TIRVER_IDENTITY_SECRET)
  .update(String(user.id))
  .digest('hex');
```

```python
# Python
import hashlib, hmac, os

user_hash = hmac.new(
    os.environ["TIRVER_IDENTITY_SECRET"].encode(),
    str(user.id).encode(),
    hashlib.sha256,
).hexdigest()
```

## 3. Pass it to the widget

Set the details before the script loads, or call `Tirver.identify` after sign-in.

```html
<script>
  window.tirverSettings = {
    widget_id: 'YOUR_WIDGET_ID',
    user_id: '42',
    user_hash: 'HASH_FROM_YOUR_SERVER',
    email: 'ada@example.com',
    name: 'Ada'
  };
</script>
<script async src="https://app.tirver.com/tirver.js"></script>
```

```js
// after the customer signs in
Tirver.identify({ user_id: user.id, user_hash: hashFromServer, email: user.email, name: user.name });
```

When the customer signs out, call `Tirver.shutdown()` so the next person on that browser starts fresh.

## Require a valid hash

Turn on **Require a valid hash before showing past conversations**. The switch is available once a secret exists. With it on, a customer whose hash does not match sees no history. Turn it on as soon as every page that loads the widget passes a hash.

Source: https://tirver.com/help/identify-signed-in-customers