User verification securely identifies people who access private widgets or pages. Your server generates a signed authentication token, and Hub uses that token to determine who may access the experience and leave feedback. Visitors do not need a separate Hub sign-in.
Use it when your application already knows who a visitor is and you want a private portal or widget to recognise that person. It is not a client-side setting: the shared secret must remain on your server.
Please refer to the implementing-user-verification.md guide to set up user verification.
Credentials and responsibilities
Section titled “Credentials and responsibilities”To implement user verification, you’ll require an Account ID as well as a Shared Secret. To access your account credentials, navigate to global Settings > User verification in Hub.
Account ID
Section titled “Account ID”The account ID uniquely identifies your release account.
Shared Secret
Section titled “Shared Secret”This is the key your server uses to sign authentication tokens. Treat it like any other server secret: store it in your server-side secret manager or environment configuration and never send it to the browser.
Rotate a shared secret
Section titled “Rotate a shared secret”Rotate the secret if it may have been exposed or if your organisation requires a regular credential rotation. Generating a replacement invalidates the old signing key, so update the server that creates tokens as part of the same change.
- Generate a new secret in the global Settings > User verification section.
- Update your server to use the new secret when generating tokens.
- Ensure all embeds and requests are updated to use tokens generated with the new secret.
Need Help?
Section titled “Need Help? ”If you run into issues, contact us and we’ll help you get started.