Server-side signing

Include aud, sub, exp and a unique jti. Name, email, company and bounded attributes are optional.

Sign the payload on your own server, where the secret lives. The browser only receives the finished token and passes it to whazzup('identify', { token }). Values set through window.whazzupSettings alone are stored as unverified profile data and never count as a verified identity.

Add this logic to your existing authenticated server endpoint. Never send the secret to React.

// Server only — never expose WHAZZUP_IDENTITY_SECRET in the browser
import { createHmac } from 'node:crypto';

const payload = {
  aud: 'YOUR_WORKSPACE_KEY',
  sub: user.id,
  exp: Math.floor(Date.now() / 1000) + 300,
  jti: crypto.randomUUID(),
  name: user.name,
  email: user.email,
  attributes: { plan: user.plan }
};
const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
const signature = createHmac('sha256', process.env.WHAZZUP_IDENTITY_SECRET)
  .update(body).digest('base64url');
return body + '.' + signature;

Store the value as WHAZZUP_IDENTITY_SECRET in the server environment. Never send it to React or expose it through public build variables.