Identify signed-in customers

When customers sign in on your website, the chatbot can know who they are — safely. Your server signs a short-lived token for the signed-in customer and your page passes it to the widget. ChatbotGen checks the signature, so nobody can pretend to be someone else. Actions marked Only for verified customers then work for that customer, and can use {{user.id}}, {{user.email}} and the other user variables.

The AI itself only learns the customer's name; the id, email and other details go only to your actions.

1. Copy the identity secret

   Open the chatbot's Actions tab and copy the identity secret (it starts with cbid_) into your server's environment, e.g. CHATBOTGEN_IDENTITY_SECRET. Never put it in browser code.

2. Sign a token on your server

   When the customer is signed in, create a JWT signed with HS256 and that secret. Required claims: sub (your customer id) and exp (expiry, e.g. one hour). Optional: email, name, phone and attributes (a flat object such as {"plan": "pro"}).

3. Pass it to the widget

   On the page, call window.chatbotgen("identify", { token }) after sign-in, and window.chatbotgen("resetUser") on logout. The snippet below queues calls made before the widget loads.

4. Mark the actions

   Turn on Only for verified customers for every action that reads or changes one customer's data.

Page snippet

Your exact script URL, with the snippet filled in, is on the Actions tab. Alternatively set window.chatbotgenSettings = { identityToken: "" } before the script loads.

Server example (Node.js)

import jwt from "jsonwebtoken"

const token = jwt.sign(
  { sub: String(user.id), email: user.email, name: user.name, exp: Math.floor(Date.now() / 1000) + 3600 },
  process.env.CHATBOTGEN_IDENTITY_SECRET,
  { algorithm: "HS256" }
)

Any JWT library works (PyJWT, firebase/php-jwt, ruby-jwt…). Only HS256 is accepted, and exp is required.

Good to know

• If a different customer signs in on the same browser, the widget starts a new conversation for them.
• If the token is expired or the signature doesn't match, the customer simply stays anonymous; verified-only actions ask them to sign in.
• WhatsApp and Telegram customers are identified by their account automatically — no token needed.
• Rotate the secret on the Actions tab if it leaks; update your server right after.

See also

• Custom actions
• Developer reference