Identity verification

Without verification anyone could open your site, call identify with someone else's id and read their conversations. Desk prevents that by asking your server to sign the id.

Visitors who are not signed inCopy Anchor Link

You do not need to sign anyone in before showing Desk. Install the widget on any page, including your landing and sign in pages, and skip identify for signed out visitors. When they open the widget, Desk starts them on a short intro screen where they type their name and email, so you can still reply by email.

Settings, Widget, Ask who they are controls that screen:

• Never: no intro screen. Visitors chat anonymously.
• Let them skip (the default): the intro shows with a Continue without option. If they skip, Desk asks for an email again when nobody is online.
• Always: visitors give an email before they can chat.

Anyone you identify with a valid hash, and anyone who already left an email, goes straight to the chat.

How it worksCopy Anchor Link

1. Copy the identity secret from Settings, Identity verification. Keep it on your server, in an environment variable.
2. When a user signs in to your app, compute userHash = HMAC_SHA256(secret, externalId) as lowercase hex.
3. Pass externalId and userHash in the identify call.

Desk recomputes the hash. If it matches, the contact is verified: their history follows them across devices and they can see their requests in the widget. If it does not match, the visitor stays anonymous and the dashboard never merges them with the real person.

Compute the hashCopy Anchor Link

import crypto from "node:crypto";

export const deskUserHash = (userId: string) =>
  crypto.createHmac("sha256", process.env.CORPLAND_DESK_IDENTITY_SECRET!).update(String(userId)).digest("hex");

Send the hash to the page with the rest of your user data, for example from a server component or your /me endpoint.

Require itCopy Anchor Link

Once your site sends a hash, turn on Require verified identity. Desk then refuses identify calls without a valid hash, so nobody can attach a name or email to an anonymous visitor.

Rotate the secretCopy Anchor Link

Rotate makes a new secret. The old one keeps working for 24 hours so you can deploy the new value without logging anyone out.

Corpland productsCopy Anchor Link

Corpland apps compute the hash in their own backend with the Corpland ID user id as externalId. For Corpland Content that is GET /api/v1/desk/identity on the Content API, which returns { externalId, name, email, userHash } for the signed in user.