Associate a website-authenticated visitor with their existing profile
A company website that has its own login passes the platform a signed identity for an already-authenticated visitor, so the widget skips the identification form and matches straight to the visitor's existing profile. An unsigned or invalid identity is never trusted.
When this happens: The website's page-load script calls the widget's JS API with a signed identity for the logged-in visitor.
How it works
- A logged-in visitor loads a page; the website's own backend computes
HMAC-SHA256(externalUserId + email + expiresAt)with the widget's secret and passes{externalUserId, email, issuedAt, expiresAt, signature}to the widget loader's JS API. AuthenticateAsyncrecomputes the HMAC with the widget's secret and compares it to the received signature.- EasyCRM checks
expiresAtis in the future andissuedAtis within clock-skew tolerance. - EasyCRM matches the visitor via FR-02 identifier rules (email, plus the website's
externalUserIdfor repeat visits) and linksVisitorSession.Contact. - EasyCRM skips the identification form entirely, even where fields on it are marked mandatory, and opens the chat directly.
Other paths
Returning authenticated visitor
A later visit reuses the stored externalUserId identity for fast matching without needing the email again.
If something goes wrong
Signature mismatch
The recomputed HMAC does not match. Throws EasyCrm:LiveChat:InvalidAuthToken; the widget falls back to the normal unidentified/identification-form flow — the unsigned claim is never trusted for any field.
Token expired
expiresAt is in the past. Same rejection as .
Good to know
- An unsigned or invalid identity is never trusted, for any field.
- The signed token is passed via a JS API call from an already-authenticated page, never via a URL query parameter.