Identify the widget visitor
Attaches your own identifier to the visitor, and — when you send identifier_hash — proves it.
Verifying changes what the session can see. Unverified, it sees only the conversations belonging to its own contact inbox. Verified, it sees every conversation belonging to the identified contact across the contact inboxes that resolve to them, so a signed-in visitor gets their history back on a new device. Compute the hash on your server; the inbox HMAC token must never reach a browser.
Authorizations
The signed session token from POST /api/v1/widget/config. Sent alongside website_token in the query string on every widget request. See /api-reference/widget-api-authentication.
Query Parameters
The web-widget inbox's public token, as it appears in your widget snippet. Required on every widget request.
"EXAMPLE_WEBSITE_TOKEN"
Body
Your own identifier for this person.
"crm-visitor-1"
HMAC-SHA256 of identifier keyed by the inbox HMAC token, computed on your server. Required when the inbox mandates identity verification, and verifying widens what the visitor can see.
Display name.
Email address.
Phone number.
Custom attributes to merge onto the contact.
Avatar image URL.
Response
Success
The identified contact.