Swaru

Help

Signed-in visitors

Tell the chat who your signed-in customer is, so their conversation follows them to any device.

This is on Growth and Scale. On Starter, every visitor is treated as anonymous.

What it changes

For a visitor your site has signed in:

  • They have one conversation on every device they use.
  • When they ask for a person, the hand-off uses the address your site vouched for, and your inbox marks it signed in on your site.
  • When your team replies from the inbox, they see the reply in the chat too. Other visitors are only told there that a person replied by email.
  • Saved replies can fill in their name.
  • On Scale, with Freemius connected, the chat can answer about their own licences and sites.

Set it up

  1. On the Chat page, find Signed-in visitors. It shows your secret and example code.
  2. On your server, for each signed-in customer, make a signature with that secret (below).
  3. In a script before the chat's line, set window.SupportWidget = {user: {id, email, name, ts, hash}};
  4. In a single-page app, call window.SupportWidget.identify(user) after someone signs in, and window.SupportWidget.identify(null) after they sign out.

The signature

ts is the current time in Unix seconds:

hash = hex(HMAC-SHA256(secret, id + "|" + lowercase(email) + "|" + ts))

PHP:    hash_hmac("sha256", "$id|" . strtolower($email) . "|$ts", $secret)
Node:   crypto.createHmac("sha256", secret).update(`${id}|${email.toLowerCase()}|${ts}`).digest("hex")
Python: hmac.new(secret.encode(), f"{id}|{email.lower()}|{ts}".encode(), hashlib.sha256).hexdigest()
Ruby:   OpenSSL::HMAC.hexdigest("SHA256", secret, "#{id}|#{email.downcase}|#{ts}")
Go:     m := hmac.New(sha256.New, []byte(secret)); m.Write([]byte(id + "|" + strings.ToLower(email) + "|" + strconv.FormatInt(ts, 10))); hex.EncodeToString(m.Sum(nil))
  • The id and the email must be plain ASCII, with no | in them. Otherwise the signature is refused.
  • Ids that start with in_, 16 letters or digits and a colon belong to sites connected with a plugin (see Connecting WordPress): your own server can't sign those.
  • A signature is good for a day, and may be up to 5 minutes ahead of our clock.
  • Anything that doesn't check out is treated as an anonymous visitor. A page can never name a user by itself.

Keep the secret safe

Keep the secret on your server: anyone with it can sign as any of your users. With Freemius connected, it can also read any customer's licences, so change it if it may have leaked.

An admin changes it with Change the secret. It also changes by itself when someone leaves your team. After a change, put the new secret on your server. Until you do, signed-in visitors are treated as anonymous, and the Chat page says when the secret changed.

Checking it works

In your browser's developer tools, look at the chat's requests. The response header X-Support-Identity says verified, invalid, none (no user was sent) or off (your plan doesn't include signed-in visitors).

Still stuck? Write to hello@getswaru.com.