Enforce verified identity

Enforce verification makes a Web Agent ignore every identity that does not come in a signed token. Turn it on once your app sends a token in every call to identify, so that nobody can attach a name or an email to a conversation from the browser console.

Before you begin

• Your backend signs a token for the signed-in user. See Verify your users with a signed token.
• Every call to identify in your app passes { jwt }. A call that passes userId, name or email stops having an effect when you turn the switch on.

To find calls that still send unverified values, open the agent's Monitoring tab and look for conversations with an Unverified badge.

Turn on Enforce verification

To accept verified identities only:

1. In the portal, go to Web Agents and select your agent.
2. Select the Settings tab, then Identity verification.
3. Turn on Enforce verification.

The description under the switch changes to "Only JWT-verified identities are accepted." The setting is not part of a version and does not need a publish.

What changes for each conversation

The chat works in every case. Enforcement changes which identity Faustine records, not who can talk to the agent.

To go back, turn the switch off. Faustine accepts unverified values again from the next message.

Troubleshooting

Next steps

• Identity verification: the identity levels and the claims of the token.
• Restrict the domains that can load the agent: limit where the widget runs.
• Read the logs: see which identity each conversation ran with.