Identify users

When you identify a signed-in user, the bot knows who it is talking to, and the conversation, leads and issues are attached to that user. Verified users also see their own chat history on any device.

1. Get the identity secret

Open Bot → Install → Identity verification, click Reveal and copy the secret. Only workspace owners and admins can see it. Keep it on your server. Never put it in client-side code.

Rotate creates a new secret. Hashes made with the old secret stop being verified until you deploy the new one.

2. Compute the hash on the server

The hash is HMAC-SHA256(identitySecret, userId) as a hex string. If you don’t pass a userId, hash the email instead.

Node.js / Next.js server

import { createHmac } from "node:crypto";

export function feedbotHash(userId: string) {
  return createHmac("sha256", process.env.FEEDBOT_IDENTITY_SECRET!).update(userId).digest("hex");
}

Python

import hmac, hashlib, os

def feedbot_hash(user_id: str) -> str:
    return hmac.new(os.environ["FEEDBOT_IDENTITY_SECRET"].encode(), user_id.encode(), hashlib.sha256).hexdigest()

PHP

$hash = hash_hmac('sha256', $userId, getenv('FEEDBOT_IDENTITY_SECRET'));

3. Pass it to the widget

<script src="https://w.feedbotai.com/v1/feedbot.js" data-bot-id="YOUR_BOT_ID" async></script>
<script>
  window.Feedbot = window.Feedbot || function () { (Feedbot.q = Feedbot.q || []).push(arguments) };
  Feedbot("identify", {
    userId: "u_123",
    email: "[email protected]",
    name: "Ann",
    hash: "HASH_FROM_YOUR_SERVER",
    metadata: { plan: "pro", signedUpAt: "2026-05-01" },
  });
</script>

Fields: userId, email, name, phone, metadata (an object, up to 4 KB; larger metadata is dropped) and hash. All are optional except that the hash needs userId or email.

Commands are queued, so you can call Feedbot(...) before the loader has finished loading. If you call identify with a different userId, the widget resets first and starts a new conversation for the new user.

With React, use the user and userHash props of @feedbotai/react instead.

Next.js example

app/feedbot-identify.tsx

"use client";
import { useEffect } from "react";

type Props = { userId: string; email: string; name: string; hash: string };

export function FeedbotIdentify(props: Props) {
  useEffect(() => {
    const w = window as any;
    w.Feedbot = w.Feedbot || function (...args: unknown[]) { (w.Feedbot.q = w.Feedbot.q || []).push(args); };
    w.Feedbot("identify", props);
  }, [props.userId]);
  return null;
}

Render it from a server component that computes hash with feedbotHash(user.id).

On logout

Feedbot("reset");

This forgets the visitor and the current conversation on this device.

Without a hash

Identity sent without a valid hash is not rejected, but the visitor stays unverified:

• name, email and phone only fill empty fields, they never overwrite what the visitor already told the bot;
• metadata is still saved;
• the visitor is not linked to your user id, so there is no chat history across devices.