Verify signed in users in your app

Inside your own app, the chat can know who is signed in. Your team then sees the user on the conversation and the chat doesn't ask for an email it already has. Because anyone can type a name or email into a web page, your server can also sign each user with your own secret key. Then your inbox and leads show a Verified user tick only when it is really them.

1. Add the chat to your signed in pages

Put your chat code in the layout every signed in page uses, and pass the user's details:

<script src="https://assistlychat.com/widget.js" data-company="your-company-id" data-user-id="{{user id}}" data-user-name="{{user name}}" data-user-email="{{user email}}" data-user-hash="{{hash from your server}}" data-user-plan="{{plan}}" data-user-company="{{company}}" data-user-created="{{signup date}}"></script>

Only data-company is required. If your app signs people in without reloading the page, set this instead (read again with every message):

window.AssistlyUser = {
  id: "123", name: "Dana Reyes", email: "dana@example.com",
  hash: "{{hash from your server}}",
  plan: "Team", company: "Cloud Ledger", created: "March 2, 2026",
  attributes: { seats: "12", role: "Admin" }
};

2. Get your secret key

Open Widget and find Verify signed in users under Show it inside your app too. Your account admin can show the key, copy it and make a new one. Keep it on your server only, like a password. It never goes into your web pages or the chat code, and we never send it to the chat.

3. Sign the user on your server

Your server signs the signed in user's id with the key (HMAC SHA256, written as lower case hex) and puts the result in data-user-hash (or hash in window.AssistlyUser). If you don't pass a user id, sign their email in lower case instead.

Node.js

const crypto = require("crypto");

// On your server: the signed in user's id, signed with your Assistly secret key
const userHash = crypto
  .createHmac("sha256", process.env.ASSISTLY_IDENTITY_SECRET)
  .update(String(user.id))
  .digest("hex");

Python

import hashlib, hmac, os

# On your server: the signed in user's id, signed with your Assistly secret key
user_hash = hmac.new(
    os.environ["ASSISTLY_IDENTITY_SECRET"].encode(),
    str(user.id).encode(),
    hashlib.sha256,
).hexdigest()

PHP

<?php
// On your server: the signed in user's id, signed with your Assistly secret key
$userHash = hash_hmac('sha256', (string) $user->id, getenv('ASSISTLY_IDENTITY_SECRET'));

Ruby

require "openssl"

# On your server: the signed in user's id, signed with your Assistly secret key
user_hash = OpenSSL::HMAC.hexdigest("SHA256", ENV["ASSISTLY_IDENTITY_SECRET"], user.id.to_s)

The same samples are on the Widget page with a copy button.

What changes in your inbox

• Verified user: the signature was right. The conversation and the lead show the tick, with the user id, plan, company, signup date and your own details.
• Not verified: no signature, or a wrong one. The inbox shows the name as "says they are", so you know not to trust it for anything about their account.
• Your bot uses plan and company in its answers only for verified users (for example "You are on the Team plan, so..."). It never sees their email.
• Webhooks to Zapier, Make or your own system carry the user's details only when the user is verified.

Only accept verified users

Turn on Only accept verified users inside the app under the key. Then a name, email or detail that comes without the right signature is ignored, and the chat treats that visitor as a guest.

Your own details

Pass up to 10 details of your own in attributes (or data-user-attributes with the same details written as JSON). Text only: names up to 40 characters and values up to 200. Anything longer is cut, and anything that isn't text is left out.

Making a new key

Click New key. The old key stops working right away, so signed in users show as not verified until your server uses the new key. The box shows when the last verified user and the last wrong signature came in, which helps you check your setup.