Whazzup

Identify users

Identity overview

Understand anonymous visitors and verified contacts.

Why verify

Anonymous visitors are useful on public pages. Signed-in products can publish the current user through window.whazzupSettings, which the widget reads automatically but stores as unverified. Verification prevents a browser user from impersonating another account by changing an email or customer ID.

Token flow

  1. 1. Your authenticated server reads the current user.
  2. 2. It signs a short-lived payload with your workspace secret.
  3. 3. The browser calls whazzup('identify', { token }).
  4. 4. Whazzup verifies the signature, audience, expiry and one-time ID.

Security rules