Identity verification

If visitors sign in to your website or app, you can tell the widget who they are. That saves them typing their email into the contact form, and lets your team see who they talked to. Because anyone can type any email address into a browser console, ASDK trusts an identity only when your server has signed it. This page explains both levels.

Two levels of identity

Without verification, identify only prefills the contact form in that visitor's browser. ASDK doesn't store the identity, because it can't know whether it's real.

Pass the signed-in user

After a visitor signs in, call identify with their details:

asdk("identify", {
  userId: "user_8412",
  email: "dana@example.com",
  name: "Dana Kim",
  userHash: "…", // from your server, see below
});

All four fields are strings and all are optional. On logout, call asdk("shutdown") so the next person on the same computer starts fresh. See JavaScript API.

How the hash works

userHash is an HMAC-SHA256 of the user's ID, keyed with your site's identity secret and written as lowercase hexadecimal. If you don't send a userId, sign the email address instead.

• Sign exactly the string you send. "8412" and "user_8412" give different hashes, and so do different upper and lower case letters.
• Compute it on your server, when you render the page or in the response that tells your front end who is signed in. The secret must never reach the browser: anyone who has it can sign any identity.
• Only the signed field is proven. When you send both userId and email, the hash covers the user ID only, so ASDK treats the user ID as verified and the email as provided by you.

This is the same construction several chat widgets use for their identity verification, so if your server already computes such a hash for another tool, the code below will look familiar.

Node.js

import { createHmac } from "node:crypto";

const userHash = createHmac("sha256", process.env.ASDK_IDENTITY_SECRET)
  .update(user.id)
  .digest("hex");

Python

import hashlib
import hmac
import os

user_hash = hmac.new(
    os.environ["ASDK_IDENTITY_SECRET"].encode(),
    user_id.encode(),
    hashlib.sha256,
).hexdigest()

PHP

$userHash = hash_hmac('sha256', $user->id, getenv('ASDK_IDENTITY_SECRET'));

The reference pages for Node.js, Python and PHP describe these functions (checked October 2026). All three return lowercase hexadecimal, which is what ASDK expects.

Turn on verification for a site

Verification is set per site and is on as soon as the site has an identity secret. Setting the secret isn't available in the dashboard yet. If you need verification during early access, write to hello@asdk.com from an owner or admin account with your Site ID, which you find on the Install page.

Once verification is on:

• an identify call with a matching userHash stores the identity with the visitor;
• a call without a hash, or with a wrong one, is treated as unverified: the form is still prefilled, but nothing is stored.

Store the secret like a password, for example in an environment variable such as ASDK_IDENTITY_SECRET. If it leaks, ask for a new one.

Test it

1. Sign in to your site and open the browser's developer tools.
2. Check that asdk("identify", …) runs with a userHash of 64 hexadecimal characters.
3. Compute the hash for the same user ID on your server or in a terminal, and compare.
4. Open the widget: the contact form, when it appears, is prefilled with the email.

A hash that doesn't match is almost always a different input string, such as a number instead of a string, extra spaces, or a different user ID format in the front end than on the server.

Privacy

Pass only what your team needs to recognize a customer. The visitor's identity becomes part of the conversation record your company controls; mention it in your privacy policy. See Data we store.

Related: Lead capture, Single-page apps.