Identify signed-in users - Frictionless

Add the chat first (install guide), then tell it who is signed in. Call Frictionless.reset() when they sign out.

<script src="https://usefrictionless.com/widget/v1.js"></script>
<script>
  Frictionless.init({ company_id: "YOUR_WORKSPACE_ID" });

  // Only for signed-in users. userHash comes from your server (below).
  Frictionless.identify({
    userId: "user_42",
    userHash: "HASH_FROM_YOUR_SERVER",
    name: "Ada Obi",
    email: "ada@example.com",
  });

  // Something that just happened on the page
  Frictionless.track("Checkout failed", { amount: "NGN 45,000", reference: "ORD_981" });
</script>

Computing userHash

userHash is the HMAC-SHA256 of the user ID, keyed with your identity secret, as lowercase hex. Compute it on your server when you render the page, so nobody can pretend to be another user by editing it.

const crypto = require("crypto");
const userHash = crypto.createHmac("sha256", process.env.FRICTIONLESS_IDENTITY_SECRET).update(user.id).digest("hex");

import hmac, hashlib, os
user_hash = hmac.new(os.environ["FRICTIONLESS_IDENTITY_SECRET"].encode(), user_id.encode(), hashlib.sha256).hexdigest()

$userHash = hash_hmac('sha256', $user->id, getenv('FRICTIONLESS_IDENTITY_SECRET'));

What agents can trust

identify() accepts a name and email but not a phone number. Send phone numbers from your server, so a visitor can’t attach themselves to someone else’s WhatsApp chat.
track() and setContext() run in the visitor’s browser, where anyone can change them, so agents see them marked “not verified”. Send anything agents must rely on, such as balances or payment outcomes, from your server.