Identity verification
Sign each user's identity on your server, so nobody can pose as another user in the widget.
Skavelo.identify runs in the browser, so in principle anyone could edit the page and claim to be someone else. Identity verification closes that gap: your server signs each user ID with a secret only it knows, and Skavelo checks the signature.
Verified conversations show a verified mark in Conversations. Owners and admins set this up under Settings, in Identity verification.
Copy your secret
In Identity verification, click Reveal secret and copy it. Store it on your server as an environment variable, for example SKAVELO_IDENTITY_SECRET. Never put it in page code.
Sign the user ID on your server
Create an HMAC-SHA256 of the user's ID with the secret, and send the result to the page along with the user's details.
import crypto from 'node:crypto';
const userHash = crypto
.createHmac('sha256', process.env.SKAVELO_IDENTITY_SECRET)
.update(user.id)
.digest('hex');Pass it to identify
Skavelo.identify({ id: user.id, userHash, name: user.name, email: user.email, plan: user.plan });Only trust verified identities
By default, identities without a valid signature are still accepted and marked as not verified. Once every page sends userHash, turn on Only trust verified identities: unsigned or incorrectly signed identities are then treated as anonymous visitors.
Rotating the secret
If your secret may have been exposed, click Create new secret. The old secret stops working immediately, so update your server promptly. Until it uses the new secret, identities show as not verified, or as anonymous if you only trust verified identities.