Messenger

Identity verification

Prove to Rabbitblaze that a Messenger visitor really is the signed-in user they claim to be, with an HMAC signed by your server.

The Messenger runs in your visitors’ browsers, where anyone can change a user_id or email. Identity verification closes that gap: your server signs the user’s id with a secret only you and Rabbitblaze know, and Rabbitblaze identifies the visitor only when the signature matches.

How it works

user_hash is the hex HMAC-SHA256 of the visitor’s user_id — or of their email (lower-cased) when you don’t send a user_id — keyed with your workspace’s identity verification secret.
A visitor booted with a valid hash is identified as that user, with their conversations, tickets and attributes.
Without a valid hash, the visitor stays an anonymous lead: the claimed id and email are kept only as the unverified attributes unverified_user_id and unverified_email, and never match an existing user.

1. Get your secret

Owners and admins find it in Settings → Messenger → Security. Store it on your server, for example as RABBITBLAZE_IDENTITY_SECRET.

2. Compute the hash on your server

Sign exactly the user_id you send to the Messenger, as a string:

import { createHmac } from "node:crypto" // On your server, for the signed-in user:const userHash = createHmac("sha256", process.env.RABBITBLAZE_IDENTITY_SECRET)  .update(String(user.id))  .digest("hex")

import hashlibimport hmacimport os user_hash = hmac.new(    os.environ["RABBITBLAZE_IDENTITY_SECRET"].encode(),    str(user.id).encode(),    hashlib.sha256,).hexdigest()

<?php$userHash = hash_hmac('sha256', (string) $user->id, getenv('RABBITBLAZE_IDENTITY_SECRET'));

require "openssl" user_hash = OpenSSL::HMAC.hexdigest("sha256", ENV.fetch("RABBITBLAZE_IDENTITY_SECRET"), user.id.to_s)

3. Pass it to the Messenger

Send the hash as user_hash with user_id, in window.rabbitblazeSettings or in Rabbitblaze("boot", …):

<script>  window.rabbitblazeSettings = {    app_id: "YOUR_APP_ID",    user_id: "48213",    email: "[email protected]",    name: "Lena Fischer",    user_hash: "{{ rabbitblaze_user_hash }}", // rendered by your server  };</script>

// Your API returns the hash with the signed-in userconst { user, rabbitblazeHash } = await fetch("/api/session").then((res) => res.json()) Rabbitblaze("boot", {  app_id: "YOUR_APP_ID",  user_id: user.id,  email: user.email,  name: user.name,  user_hash: rabbitblazeHash,})

4. Require verification

Once every page that identifies users sends a hash, turn on Require identity verification in Settings → Messenger → Security. From then on, boots that claim an identity without a valid hash are refused. Anonymous visitors (no user_id or email) still get the Messenger as leads.

Error code	When
`identity_verification_failed`	A user_hash was sent but doesn’t match. Always refused, whether or not verification is required.
`identity_verification_required`	Verification is required and a visitor with a user_id or email was booted without a user_hash.

The Messenger doesn’t open when its boot is refused; the reason is logged in the browser console.

Troubleshooting

Sign what you send. If you send a user_id, the hash must cover that id — not the email. Numbers and strings sign the same once converted (48213 → "48213").
Hex, not base64. The hash is the lowercase hexadecimal digest (64 characters).
Rotated secret? Hashes made with the previous secret fail with identity_verification_failed.
Users signing out. Call Rabbitblaze("shutdown") so the next person on the same device starts a fresh, anonymous session.