# Enforce verified identity

**Enforce verification** makes a Web Agent ignore every identity that does not come in a signed token. Turn it on once your app sends a token in every call to `identify`, so that nobody can attach a name or an email to a conversation from the browser console.

## Before you begin

- Your backend signs a token for the signed-in user. See [Verify your users with a signed token](https://docs.faustine.ai/web-agents/verify-users/).
- Every call to `identify` in your app passes `{ jwt }`. A call that passes `userId`, `name` or `email` stops having an effect when you turn the switch on.

To find calls that still send unverified values, open the agent's **Monitoring** tab and look for conversations with an **Unverified** badge.

## Turn on Enforce verification

To accept verified identities only:

1. In the portal, go to [**Web Agents**](https://auth.faustine.ai/go?to=%2Fweb-assistants) and select your agent.
2. Select the **Settings** tab, then **Identity verification**.
3. Turn on **Enforce verification**.

The description under the switch changes to "Only JWT-verified identities are accepted." The setting is not part of a version and does not need a publish.

## What changes for each conversation

| What your app sends | Enforce verification off | Enforce verification on |
| --- | --- | --- |
| Nothing | Anonymous | Anonymous |
| `identify({ userId, name, email })` | The values appear in the **Monitoring** tab with an **Unverified** badge. | Faustine ignores the values. The conversation is anonymous. |
| `identify({ jwt })` with a valid token | Verified | Verified |
| `identify({ jwt })` with a token that is expired or does not verify | Anonymous | Anonymous |

The chat works in every case. Enforcement changes which identity Faustine records, not who can talk to the agent.

To go back, turn the switch off. Faustine accepts unverified values again from the next message.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| Users who appeared by name in the **Monitoring** tab now appear as `Anonymous` | A call to `identify` passes `userId`, `name` or `email` without a token. | Pass the token: `identify({ jwt })`. |
| A user with a token appears as `Anonymous` | The token is expired, has no `exp`, or was signed with another secret. | Sign with HS256 and the secret of this agent, and set `exp` no more than 24 hours ahead. |

## Next steps

- [Identity verification](https://docs.faustine.ai/web-agents/identity-verification/): the identity levels and the claims of the token.
- [Restrict the domains that can load the agent](https://docs.faustine.ai/web-agents/restrict-domains/): limit where the widget runs.
- [Read the logs](https://docs.faustine.ai/web-agents/logs/): see which identity each conversation ran with.