roko
Documentation

Identity verification (HMAC)

Prevent user impersonation in support chat by verifying every identify() call with a server-generated HMAC-SHA256 hash.

How it works

Your server holds the rk_is_ identity secret. Hash the immutable user id with HMAC-SHA256 and pass only the hex digest to the browser. rokochat verifies the hash before linking the session.

Generate user_hash on your server

import { createHmac } from "node:crypto";

const user_hash = createHmac("sha256", process.env.ROKOCHAT_IDENTITY_SECRET!)
  .update(userId)
  .digest("hex");

Call identify() in the browser

Rokochat.identify({
  id: user.id,
  user_hash: serverProvidedHash,
  email: user.email,
  name: user.name,
  avatar_url: user.avatar,
  attributes: { plan: "pro" },
});

Always call Rokochat.logout() when the user signs out.