Identity verification
A secure chatbot for your logged-in users
Your server signs the signed-in user's id with a secret only you and intoCHAT know. The agent then knows who is chatting, your actions can look up that user's own data, and you can keep the chat for signed-in users only.
Visitor: How many seats do I have left on my plan?
Agent: Hi Ada! I checked your account: you are on the Team plan and use 7 of your 10 seats, so 3 are free. Would you like to know how to invite someone?
Visitor: No thanks, that is all I needed.
A chat widget alone can't tell who is typing
Inside your app or customer portal, people ask about their own account: their plan, their invoices, their orders. A plain chat widget can't tell who is typing. If the page simply passes a user id or an email address, anyone can change it in the browser and ask about someone else's account. So the agent either refuses everything personal, or becomes a risk. Identity verification solves this with a signature your server creates. A user id without a valid signature isn't trusted, so a visitor can't pretend to be another user.
What identity verification gives you
One secret per agent, one line of server code, and a call on the page.
Nobody can pose as another user
Your server signs the user id with HMAC-SHA256 and intoCHAT's server checks the signature on every message. A visitor who changes the id in the browser just chats as an unverified visitor.
Actions that use the user's own data
Server-side API actions can use {{user.id}}, {{user.email}}, {{user.name}} and {{user.metadata.<key>}}. intoCHAT fills them in on its servers, from the verified identity only. The AI never sees or chooses them.
Chat for signed-in users only
Switch on Only verified visitors can chat and the widget asks visitors to sign in instead of showing the message field. The chat API refuses messages without a valid identity too.
Know who you talked to
Verified conversations show Verified and the user id, with the name and email your page passed. Each verified visitor is kept as a contact of the agent, matched by user id only.
The AI learns as little as possible
The AI is told that the visitor is verified and their name, so it can greet them. It never gets the email address, the user id or the metadata, so it can't repeat them or be talked into revealing them.
How to set it up
Generate a secret
Open your agent, go to the Share tab and click Generate secret on the Identity verification card. Store the secret on your server, for example in an environment variable. It never belongs in your HTML or JavaScript.
Sign the user id on your server
For the signed-in user, compute userHash: the HMAC-SHA256 of the user id, keyed with the secret, as lowercase hexadecimal. It is one line in Node.js, PHP or Python. Render the id and the hash into the page.
Call IntoChat.identify on the page
After the script tag, call IntoChat.identify with userId and userHash, and optionally name, email and metadata, on every page load while the user is signed in. The widget sends the identity with every message.
Call IntoChat.reset on sign-out
When the user signs out, IntoChat.reset forgets the identity and starts a new chat, so the next person on that browser doesn't see the previous conversation. Identifying a different user starts a new chat by itself.
Identity verification in detail
A standard HMAC signature
userHash is the HMAC-SHA256 of exactly the text you pass as userId, keyed with the secret, in lowercase hex. The docs show it in Node.js, PHP and Python. No extra library or service is needed.
Placeholders filled on the server
For a visitor who isn't verified, the {{user.*}} placeholders stay empty and empty fields are left out of the request. Even if the AI writes something that looks like {{user.id}}, it is sent as plain text.
Client-side actions get the user too
A client-side action handler on your page receives the visitor as context.user. Because its request is built in the visitor's browser, the {{user.*}} placeholders stay empty there.
Verified in exports and webhooks
The conversations CSV export has a Verified user ID column, and the webhooks for leads, forms and bookings include an identity object, so your systems know which user it was.
Test as a signed-in visitor
In the Playground, expand Test as a signed-in visitor and enter a user ID, a name, an email and metadata. Your messages count as verified without a signature. Only the owner, admins and editors can use it.
A secret only admins handle
Only the owner and admins can generate, reveal or rotate the secret, which is stored encrypted. Editors see whether one is set and its last four characters. Rotate stops the old secret at once.
Billing questions for verified users
On Pro and Enterprise, Stripe billing self-service lets the agent show verified visitors their invoices and subscription from your Stripe account. It only works for visitors your site signs in.
On every plan
Identity verification and Only verified visitors can chat are available on every plan, Free too. It needs the chat bubble from the script tag, because the identity comes from your page.
Frequently asked questions
What is chatbot identity verification?
It lets your website tell the chatbot who a signed-in visitor is, in a way nobody can fake. Your server signs the user's id with a secret only you and intoCHAT know, your page passes the id and the signature to the widget, and intoCHAT checks the signature with every message.
How do I create the user hash?
Compute the HMAC-SHA256 of the user id, keyed with the agent's secret, and write it as lowercase hexadecimal. Sign exactly the text you pass as userId. Do it on your server, never in the browser, then pass userId and userHash to IntoChat.identify.
Can I keep the chat for logged-in users only?
Yes. Switch on Only verified visitors can chat on the Identity verification card. Visitors without a valid signature see a short notice asking them to sign in, in the widget's language, and the chat API refuses their messages with the reason identity_required. Your own Playground keeps working.
What does the AI know about the user?
Only that the visitor is signed in and verified, and the name your page passed, which it may use to greet them. It never gets the email address, the user id or the metadata. Server-side actions use those values, filled in by intoCHAT, so the AI can't read them out or swap in someone else's id.
Is the name, email and metadata signed too?
No, only the user id is signed. The name, email and metadata are what your page passes alongside a valid signature, so a signed-in user could change their own copy in the browser. Look up anything that matters, such as orders, invoices or permissions, by {{user.id}} on your side.
Does it work with the inline iframe, the chat link or the Help Page?
No. The identity comes from your page through the JavaScript SDK, so it needs the chat bubble from the script tag. The inline iframe, the share link and the Help Page can't identify anyone, so with Only verified visitors can chat on, they only show the sign-in notice.
What happens if the signature is wrong?
The visitor is never shown an error. They simply chat as an unverified visitor, and the {{user.*}} placeholders stay empty. With Only verified visitors can chat on, they see the sign-in notice instead. After you rotate the secret, everyone counts as unverified until your server signs with the new one.
Which plan do I need?
Identity verification, Only verified visitors can chat and the {{user.*}} placeholders are on every plan, Free included. Verified visitors become contacts up to your plan's contacts per agent: 100 on Free, 5,000 on Starter, 25,000 on Pro. Stripe billing self-service for verified visitors is on Pro and Enterprise.
Let your agent know who it is talking to
Create your agent free, generate a secret on the Share tab and try Test as a signed-in visitor in the Playground before you add one line to your server.
Create your agent freeFree plan, no credit card needed.