Identify logged-in visitors
Verify who is chatting with a signed JWT so agents see real customer context.
Verify who is chatting with a signed JWT so agents see real customer context.
Anonymous chat is fine for marketing pages. If your visitors are logged into your app or store, identity verification tells Lunadesk who is chatting — securely, so nobody can impersonate someone else by typing their email.
How it works
At channel creation, Lunadesk shows the widget's JWT secret once. Store it in your secret manager — never in frontend code.
Your backend signs a short-lived JWT containing the user's id, email and name.
The browser passes that JWT to the widget at boot.
Keep the secret server-side. It is shown once and belongs in your secret manager — never in frontend code.
Backend example (Node.js)
const jwt = require('jsonwebtoken');
function signLunadeskIdentity(user) {
return jwt.sign(
{
user_id: user.id,
email: user.email,
name: user.fullName,
custom_attributes: { plan: user.plan },
},
process.env.LUNADESK_WIDGET_SECRET,
{ expiresIn: '1h' }
);
}
Browser side
<script>
window.lunadeskSettings = { widgetKey: 'lw_YOUR_KEY' };
</script>
<script src="https://app.lunadesk.ai/api/v1/widget/v1/widget.js" defer></script>
<script>
document.addEventListener('DOMContentLoaded', () => {
window.lunadesk('boot', { jwt: 'JWT_FROM_YOUR_SERVER' });
});
</script>What agents get
The conversation shows the verified customer with their profile, past tickets and orders — instead of an anonymous visitor.
On logout, call lunadesk('shutdown') so the next person on the same browser starts fresh.
A signed token turns an anonymous visitor into a verified customer with full context.