Identity tokens

When you call identify() from the browser, the workspace ID and participant profile are public. To verify that a widget user really is one of your users, sign their identity with a private key only your servers hold.

How it works

1. Your workspace registers an identity signing key. Sey stores the public key; the private key is shown to you once, at creation time.
2. Your backend signs a short-lived JWT with the private key.
3. The widget passes the JWT to identify({ token }).
4. Sey verifies the JWT against the registered public key and marks the participant's email as verified.

Token requirements

The JWT must use:

• Algorithm EdDSA (Ed25519).
• Audience aud: "sey".
• A lifetime of at most 10 minutes. exp must not be more than 10 minutes after iat.
• iat must not be in the future (a 60-second clock skew is allowed).
• exp must be in the future.

Example

A minimal signed token payload looks like:

{
	"sub": "user_123",
	"email": "alex@example.com",
	"name": "Alex Rivera",
	"aud": "sey",
	"iat": 1700000000,
	"exp": 1700000600
}

Sign it with the private key returned when you created the signing key, then pass it to the widget:

await window.sey.identify({ token: signedJwt });

Managing signing keys

Workspace owners manage identity signing keys. Keys can be active or inactive. Deactivating a key stops Sey from verifying tokens signed with it, but does not delete the public key record.

Next

• Widget SDK reference
• Authentication
• Install the widget