AloriWebsite

Know who's chatting: identify signed-in users

Updated October 22, 2026

If people sign in on your website or product, the chat can know who they are. Their name and email are filled in, the team sees who they are in Conversations, the bot doesn't ask for their contact details, and their chats follow them to any device.

It works like Intercom's identify. If you're moving from Intercom, the same names work too: boot, update, shutdown, user_id and user_hash.

Before you start

The chat must already be on your website. If it isn't, open Front desk, copy the line under Use it on another website, and paste it before </body>.

1. Add the identify call

Once your user is signed in, add this to the page, before the chat's line or after it:

<script>
  window.Alori=window.Alori||function(){(Alori.q=Alori.q||[]).push(arguments)};
  Alori("identify", {
    userId: "USER_ID",
    email: "USER_EMAIL",
    name: "USER_NAME",
    userHash: "USER_HASH"
  });
</script>

Replace each value with your signed-in user's details. Every field is optional except one of userId, email, name or phone. You can also send:

  • phone: their phone number

  • company: their company's name

  • attributes: up to 20 extra facts, like { plan: "Pro", seats: 3 }. The team sees them in Conversations, and the bot reads them.

2. Sign it with your secret key

userHash proves the user is really who the page says. Without it, anyone could type someone else's email and pretend to be them.

  1. Open Front desk and find Know who's chatting.

  2. Click Show secret key and copy it.

  3. Keep the key on your server, never in the page. On your server, compute the HMAC-SHA256 of the user id with the key, and put the result in userHash.

In Node:

const userHash = crypto.createHmac("sha256", SECRET_KEY).update(userId).digest("hex");

If you don't send a userId, sign the email instead.

Without a userHash, the chat still uses the name and email, but only as much as if the visitor had typed them. The user's chats won't follow them to other devices.

3. Log them out

When your user signs out, call:

Alori("logout");

The chat forgets them on that browser, so the next person on the same computer starts a new chat. Their past chats stay safe with them.

Other commands

  • Alori("open") opens the chat, for example from a "Talk to us" button.

  • Alori("close") closes it.

What you'll see

In Conversations, above the chat:

  • Signed in on the website, with a check mark: the user was signed with your key. Their user id, company and attributes show next to it.

  • Says who they are on the website (not verified): the page sent a name or email without a valid userHash.

A signed user's chat goes on the customer they already are, found by their user id, then their email or phone. If they're not in your CRM yet, they're added with the details your website sent.

Built with Alori