Signed-in visitors

If your visitors sign in on your site, a customer portal, a shop account or an app, your agent can know who it is talking to: their name, their plan, their open orders, whatever helps it answer. Your server says so in a short token, signed with the agent's own secret, and your page hands the token to the widget. The agent then answers about the visitor's own situation, and does not ask them for their contact details.

Nothing the browser says about a visitor reaches the agent unless your server signed it.

Setting it up#

1. On Deploy, under Signed-in visitors, choose Make a secret and put it in your server's configuration. Show the secret shows it again later.
2. On your server, for a signed-in visitor, make a JSON Web Token signed with HS256 and that secret, with these fields:

In Node, with the jsonwebtoken package:

import jwt from "jsonwebtoken";

const token = jwt.sign(
  { sub: user.id, name: user.name, context: { plan: user.plan, openOrders: user.openOrders } },
  process.env.CHATTERLAB_IDENTITY_SECRET,
  { algorithm: "HS256", expiresIn: "1h" },
);

1. Hand the token to the widget on the page, below the script tag:

<script>
  ChatterLab("identify", "THE-TOKEN-YOUR-SERVER-MADE");
</script>

Make a fresh token for every page view, and give a new one before the old expires on a page that stays open. When the visitor signs out, call ChatterLab("identify", null).

If your page may make the call before the widget's script has loaded, put the one-line stub from Greeting and nudge above it, so that the call waits for the script.

What the agent does with it#

• It reads what the token says as information about the visitor, never as instructions, and checks it for text phrased as instructions to an AI, as it does your pages and files.
• It does not ask a signed-in visitor for their name or contact details, and the contact form is not offered to them.
• A signed-in visitor's conversation is theirs. After a reload it comes back only to them, and when somebody else signs in on the same computer, the chat starts over.

What it does not do#

• The token is as private as your page. Put in context only what the visitor may see themselves.
• The iframe snippet takes no token. Use the script tag.
• What the token says is not stored, except your id for the visitor, which is kept with the conversation so that it comes back only to them, and the email, which a ticket the visitor opens keeps as its address. The agent's answers are stored, as every conversation is. See Data and privacy.

When it does not work#

A visitor whose token is not taken is answered like anyone else. The chat's answer says why, in the response header x-visitor-identity-status, which you see in your browser's developer tools:

A new secret#

Make a new secret replaces the secret at once. Tokens signed with the old one stop working, and signed-in visitors are answered like anyone else until your server signs with the new one.