Introduce a signed-in customer to the widget

Steps

1

Generate a key on the Install tab

The Identity verification section sits at the bottom of the Install tab in site settings. Generate key hands you a secret shown only once; you will sign your tokens with it.



Keep the key in your server's environment. A key that reaches the browser means anyone can appear as anyone.

2

Sign the token on your server

Issue a JWT signed with HS256 for the signed-in user. sub is required: the user's id in your system. name, email and attrs are optional, and exp keeps the token short-lived.

Mint the token on each page load and keep the lifetime short. An hour-long token should not outlive the user's sign-out by an hour.

3

Pass it with identify on the page

lunachat('identify', token) hands the identity to the widget. The server verifies the token and writes the name and email onto the contact as verified, where the panel shows them with a check.

4

Call shutdown on sign-out

When the user signs out of your site, lunachat('shutdown') clears the visitor token and removes the widget. On a shared computer this call is not optional: without it, the next person to sign in on that browser sees the previous one's chat history.