# User Verification

User verification securely identifies people who access private widgets or pages. Your server generates a signed authentication token, and Hub uses that token to determine who may access the experience and leave feedback. Visitors do not need a separate Hub sign-in.

Use it when your application already knows who a visitor is and you want a private portal or widget to recognise that person. It is not a client-side setting: the shared secret must remain on your server.

## Setup

Please refer to the [implementing-user-verification.md](/guide/getting-started/setup-guide/implementing-user-verification/ "mention") guide to set up user verification.

## Credentials and responsibilities

To implement user verification, you'll require an Account ID as well as a Shared Secret. To access your account credentials, navigate to global **Settings** **> User verification** in Hub.

### **Account ID**

The account ID uniquely identifies your release account.

### Shared Secret

This is the key your server uses to sign authentication tokens. Treat it like any other server secret: store it in your server-side secret manager or environment configuration and never send it to the browser.

> **Keep your secret safe!**
>
> Never expose it in client-side code or public repositories.

#### Rotate a shared secret

Rotate the secret if it may have been exposed or if your organisation requires a regular credential rotation. Generating a replacement invalidates the old signing key, so update the server that creates tokens as part of the same change.

1. Generate a new secret in the global **Settings** > **User verification** section.
2. Update your server to use the new secret when generating tokens.
3. Ensure all embeds and requests are updated to use tokens generated with the new secret.

## Need Help? 

If you run into issues, [contact us](https://released.so/support) and we’ll help you get started.