Verify your customers' identity

Identity verification tells Helpium, securely, which of your users is chatting. Your server signs a short token with your workspace's identity secret, and the web widget or the mobile SDK passes it along.

With a verified identity:

• The customer keeps one conversation that follows them across devices: from your website to the app and back.
• The pre-chat form is skipped, because Helpium already knows their name and email.
• AI actions can act on their account (look up orders, change a booking) because Helpium knows the request really comes from that user.

Without it, a visitor can still chat and leave an email, but they are treated as unverified.

1. Copy the identity secret

In Helpium, open Channels → Live Chat and copy the identity secret. Keep it on your server only. Anyone who has it could pretend to be any of your users.

2. Sign a token on your server

The token is an HS256 JWT with these claims:

Claim	Required	Description
user_id	Yes (or email)	Your user's id, as a string
email	Recommended	Needed for the conversation to follow the user to another device
exp	Yes	When the token expires, as a Unix timestamp

Expose an endpoint for signed-in users, such as GET /api/helpium-token, that returns it:

use Firebase\JWT\JWT;

$userJwt = JWT::encode([
    'user_id' => (string) $user->id,
    'email' => $user->email,
    'exp' => time() + 3600,
], env('HELPIUM_IDENTITY_SECRET'), 'HS256');

const jwt = require('jsonwebtoken');

const userJwt = jwt.sign(
  { user_id: String(user.id), email: user.email },
  process.env.HELPIUM_IDENTITY_SECRET,
  { algorithm: 'HS256', expiresIn: '1h' }
);

import jwt, os, time

user_jwt = jwt.encode(
    {"user_id": str(user.id), "email": user.email, "exp": int(time.time()) + 3600},
    os.environ["HELPIUM_IDENTITY_SECRET"],
    algorithm="HS256",
)

3. Pass it to Helpium

Web widget

Helpium.identify({ userJwt: tokenFromYourServer, email: user.email });

iOS

Helpium.identify(userJwt: tokenFromYourServer)

Android

Helpium.identify(tokenFromYourServer);

React Native

Helpium.identify({ userJwt: tokenFromYourServer });

Call it right after the user signs in. When they sign out, call Helpium.logout() in the apps so the next person on the same phone starts fresh.

Rotating the secret

If the secret leaks, regenerate it in Channels → Live Chat. Tokens signed with the old secret stop working immediately, so update your server at the same time.