Prefill visitor details without treating browser-supplied identity as authentication.
Assistant('identify', user) supplies a visitor name and email so Chat and Contact can skip or
prefill those questions.
Assistant('ready', () => {
Assistant('identify', {
name: 'Jane Cooper',
email: '[email protected]'
});
});Identification is not verification
No JWT- or HMAC-based Assistant identity contract is publicly documented. Values passed from
browser JavaScript can be changed by the visitor. Do not use identify to authorize access to
account data, invoices, orders, or private conversations.
Use your own authenticated backend for sensitive data. When the Assistant or a SmartApp calls that backend, enforce the application session there and return only data the current user may access.
Never embed API keys, signing secrets, or unrestricted bearer tokens in the browser.