> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usefrictionless.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identify signed-in users

> Tell the chat who is signed in, and what just happened on the page.

Add the chat first ([install guide](/website-chat/install)), then tell it who is signed in. Call `Frictionless.reset()` when they [sign out](/website-chat/control#signing-out).

```html theme={null}
<script src="https://usefrictionless.com/widget/v1.js"></script>
<script>
  Frictionless.init({ company_id: "YOUR_WORKSPACE_ID" });

  // Only for signed-in users. userHash comes from your server (below).
  Frictionless.identify({
    userId: "user_42",
    userHash: "HASH_FROM_YOUR_SERVER",
    name: "Ada Obi",
    email: "ada@example.com",
  });

  // Something that just happened on the page
  Frictionless.track("Checkout failed", { amount: "NGN 45,000", reference: "ORD_981" });
</script>
```

## Computing userHash

`userHash` is the HMAC-SHA256 of the user ID, keyed with your [identity secret](/authentication), as lowercase hex. Compute it on your server when you render the page, so nobody can pretend to be another user by editing it.

<CodeGroup>
  ```js Node.js theme={null}
  const crypto = require("crypto");
  const userHash = crypto.createHmac("sha256", process.env.FRICTIONLESS_IDENTITY_SECRET).update(user.id).digest("hex");
  ```

  ```python Python theme={null}
  import hmac, hashlib, os
  user_hash = hmac.new(os.environ["FRICTIONLESS_IDENTITY_SECRET"].encode(), user_id.encode(), hashlib.sha256).hexdigest()
  ```

  ```php PHP theme={null}
  $userHash = hash_hmac('sha256', $user->id, getenv('FRICTIONLESS_IDENTITY_SECRET'));
  ```
</CodeGroup>

## What agents can trust

* `identify()` accepts a name and email but not a phone number. Send phone numbers [from your server](/context-api/server), so a visitor can't attach themselves to someone else's WhatsApp chat.
* `track()` and `setContext()` run in the visitor's browser, where anyone can change them, so agents see them marked "not verified". Send anything agents must rely on, such as balances or payment outcomes, from your server.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.