Identify your signed-in customers

An in-app chat window needs one thing from your product: a small signed token that says who the signed-in customer is. It takes about fifteen minutes and one short piece of code on your server.

Chatty cannot see inside your product. The token is how your server vouches for the customer, so Chatty can:

• put their name and email on any ticket;
• recognise the same person next time, on any device;
• show them the help written only for signed-in customers.

Without a valid token a visitor is treated as anonymous, whatever the page says.

Before you start

1. In Channels, click Add a channel and choose Inside an app. The channel is made Active, with a secret.
2. On the last step, copy the secret. It is shown once. To make a new one later, open the channel, go to Who and where, and click Make a new secret.
3. Keep the secret on your server only. Never put it in the page, the app bundle or a repository.
4. Note the channel's audience. It is the channel's id unless you set your own.

Prefer not to share a secret? Choose Public key (RS256) on the channel instead, sign with your private key, and Chatty only ever holds the public half.

Step 1: sign the token on your server

When a signed-in customer opens a page that shows the chat window, your server creates a token. It must:

• be signed with HS256 using your secret (or RS256 with a private key);
• carry the customer's id as sub, and optionally name, email and any extra facts you want Chatty to know, such as plan;
• name the channel in aud;
• expire soon. An hour is plenty (exp).

Node.js

import jwt from 'jsonwebtoken';

const token = jwt.sign(
  { sub: user.id, name: user.name, email: user.email, plan: user.plan },
  process.env.CHATTY_SECRET,
  { algorithm: 'HS256', audience: 'YOUR-CHANNEL-ID', expiresIn: '1h' }
);

.NET

using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using Microsoft.IdentityModel.Tokens;

var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Environment.GetEnvironmentVariable("CHATTY_SECRET")!));
var token = new JwtSecurityTokenHandler().WriteToken(new JwtSecurityToken(
    audience: "YOUR-CHANNEL-ID",
    claims: [new Claim("sub", user.Id), new Claim("name", user.Name), new Claim("email", user.Email), new Claim("plan", user.Plan)],
    expires: DateTime.UtcNow.AddHours(1),
    signingCredentials: new SigningCredentials(key, SecurityAlgorithms.HmacSha256)));

Python

import os, time, jwt  # pip install pyjwt

token = jwt.encode(
    {"sub": user.id, "name": user.name, "email": user.email, "plan": user.plan,
     "aud": "YOUR-CHANNEL-ID", "exp": int(time.time()) + 3600},
    os.environ["CHATTY_SECRET"], algorithm="HS256")

PHP

use Firebase\JWT\JWT; // composer require firebase/php-jwt

$token = JWT::encode([
    'sub' => $user->id, 'name' => $user->name, 'email' => $user->email, 'plan' => $user->plan,
    'aud' => 'YOUR-CHANNEL-ID', 'exp' => time() + 3600,
], getenv('CHATTY_SECRET'), 'HS256');

Any language with a JWT library works the same way.

Step 2: give the token to the chat window

Add the token to the install snippet. Your server puts it into the page, so it is new on every page load:

<script src="https://api.askmychatty.com/widget/v1/widget.js" async></script>
<script>
  window.addEventListener('load', function () {
    Chatty.init({
      key: "pk_your_channel_key",
      api: "https://api.askmychatty.com",
      mode: "app",
      userToken: "THE-TOKEN-FROM-STEP-1",
      context: { route: location.pathname, title: document.title }
    });
  });
</script>

See Install the chat window for every option. If the customer signs in after the page has loaded, call Chatty.identify(token).

Step 3: check it works

1. Sign in to your product as a test customer and open the chat window.
2. Ask a question. In the Inbox the conversation shows the customer's name and email, marked as signed in.
3. Open the chat window while signed out. The visitor should be anonymous.

If it does not work

• Shown as anonymous when signed in: the token is missing, expired, signed with the wrong secret, or its aud is not the channel's audience. Chatty does not say which, on purpose.
• Works for a while, then stops: the token expired. Create a fresh one each time the page loads.
• You lost the secret: open the channel and choose Make a new secret. Update your server with it. The old one stops working.

Keep in mind

• Put only what Chatty needs in the token. Everything in it is stored with the customer's record in Chatty.
• Never log the token, and never put the secret in front-end code.