Verify signed-in customer identity

When you need this

The widget runs inside your website, so anything it sends about a visitor is only as trustworthy as the browser. That is fine for personalization — greeting someone by name, or attaching their details to a support handoff — because nothing private depends on it.

It is not enough when the assistant must read a specific customer's private data (an order status, a subscription, an invoice). There, an unverified identity would let one visitor request another visitor's data. Verification closes that gap: your server signs a token with a secret only it and AskBrew share, and AskBrew verifies it before trusting the identity.

Two methods are supported: a signed JWT (recommended) and an HMAC hash (a simpler fallback). Both start from the same secret in Chat Widget → Identity verification (available on Pro and Scale).

1. Get your identity secret

1. 1Open Chat Widget in the dashboard and expand Identity verification (Pro and Scale).
2. 2Click Reveal secret and copy it into your server's environment, for example ASKBREW_IDENTITY_SECRET.
3. 3Rotate the secret any time it may be exposed. Rotating immediately invalidates tokens signed with the old value, so redeploy your signing code with the new secret.

2. Backend — sign a token at login

When a customer signs in, mint a short-lived token on your server. Put public profile fields (name, email) and any private values an action will need (such as a Stripe customer id) in the payload. Private claims are passed to your action endpoints but never shown to the AI.

const jwt = require("jsonwebtoken");

const token = jwt.sign(
  {
    sub: user.id,              // required: stable user id (string)
    name: user.name,           // public — may be shown by the assistant
    email: user.email,         // public
    stripe_id: user.stripeId,  // private — used by actions, never shown
    exp: Math.floor(Date.now() / 1000) + 3600, // 1 hour
  },
  process.env.ASKBREW_IDENTITY_SECRET,
  { algorithm: "HS256" }
);
// send `token` to the browser for the logged-in page

import jwt, time

token = jwt.encode(
    {
        "sub": user.id,
        "name": user.name,
        "email": user.email,
        "stripe_id": user.stripe_id,  # private claim
        "exp": int(time.time()) + 3600,
    },
    os.environ["ASKBREW_IDENTITY_SECRET"],
    algorithm="HS256",
)

const crypto = require("crypto");

const hash = crypto
  .createHmac("sha256", process.env.ASKBREW_IDENTITY_SECRET)
  .update(String(user.id))
  .digest("hex");
// send `hash` and the user id to the browser

3. Frontend — identify the visitor

Once the token (or hash) is on the page, call AskBrew.identify. With a JWT you pass the token plus any public fields you want the assistant to see. With the hash method you pass the same user id you hashed, the hash, and public metadata.

AskBrew.identify({
  token: token,     // signed on your server
  name: user.name,  // public metadata (optional)
});

AskBrew.identify({
  customerId: String(user.id), // the value you hashed
  hash: hash,                  // from your server
  name: user.name,
});

AskBrew.resetUser(); // clears identity for the next visitor

4. Confirm it worked

Send a message from a signed-in session. In Conversations, a verified visitor is marked as identity-verified. If it is not, check that the secret matches, the user id is a string, and the token has not expired.

• Signature or hash generated with the current secret.
• user id is a string (a number will not match).
• JWT exp is in the future.
• AskBrew.identify runs after the widget script has loaded.

Require verification for actions

The Require verification for account actions toggle controls what happens for unverified visitors. Left off, they can still chat and receive personalized greetings. Turned on, unverified visitors keep chatting but the assistant will not run any action that reads their account data — only verified visitors can.