# Identity verification (/docs/installing/identity-verification)

`Skavelo.identify` runs in the browser, so in principle anyone could edit the page and claim to be someone else. Identity verification closes that gap: your server signs each user ID with a secret only it knows, and Skavelo checks the signature.

Verified conversations show a verified mark in Conversations. Owners and admins set this up under **Settings**, in **Identity verification**.

<Steps>
<Step>

### Copy your secret [#copy-your-secret]

In **Identity verification**, click **Reveal secret** and copy it. Store it on your server as an environment variable, for example `SKAVELO_IDENTITY_SECRET`. Never put it in page code.

</Step>
<Step>

### Sign the user ID on your server [#sign-the-user-id-on-your-server]

Create an HMAC-SHA256 of the user's ID with the secret, and send the result to the page along with the user's details.

<Tabs items={['Node.js', 'Python']}>
<Tab value="Node.js">

```js
import crypto from 'node:crypto';

const userHash = crypto
  .createHmac('sha256', process.env.SKAVELO_IDENTITY_SECRET)
  .update(user.id)
  .digest('hex');
```

</Tab>
<Tab value="Python">

```python
import hashlib, hmac, os

user_hash = hmac.new(
    os.environ["SKAVELO_IDENTITY_SECRET"].encode(),
    str(user.id).encode(),
    hashlib.sha256,
).hexdigest()
```

</Tab>
</Tabs>

</Step>
<Step>

### Pass it to identify [#pass-it-to-identify]

```js
Skavelo.identify({ id: user.id, userHash, name: user.name, email: user.email, plan: user.plan });
```

</Step>
</Steps>

## Only trust verified identities [#only-trust-verified-identities]

By default, identities without a valid signature are still accepted and marked as not verified. Once every page sends `userHash`, turn on **Only trust verified identities**: unsigned or incorrectly signed identities are then treated as anonymous visitors.

## Rotating the secret [#rotating-the-secret]

If your secret may have been exposed, click **Create new secret**. The old secret stops working immediately, so update your server promptly. Until it uses the new secret, identities show as not verified, or as anonymous if you only trust verified identities.