HMAC (user_hash)
The legacy Intercom-style identity proof — an HMAC-SHA256 of the user id
The HMAC proof mirrors Intercom's legacy user_hash. It's a drop-in path if you're migrating, but it has no expiry — prefer a signed JWT for new integrations.
How it works
Compute an HMAC-SHA256 of your user's id, keyed with the integration's shared secret, on your server:
user_hash = HMAC-SHA256( sharedSecret, user_id ) // hex, lowercaseimport crypto from "crypto";
const userHash = crypto
.createHmac("sha256", process.env.WEXIO_INTEGRATION_SECRET)
.update(user.id)
.digest("hex");Hand it to the widget
Pass userId and userHash together, plus any profile data:
// React
<WexioWidget
publicKey="pk_live_..."
user={{
userId: user.id,
userHash: serverComputedHash,
name: "Ada Lovelace",
email: "ada@example.com",
}}
/>// Web Component
el.identify({ userId: user.id, userHash, name: "Ada" });
// Script loader
window.Wexio("identify", { userId: user.id, userHash, name: "Ada" });The backend recomputes the HMAC with the decrypted secret and compares it in constant time. On a match it establishes a verified session keyed on your userId.
Trade-offs vs JWT
HMAC user_hash | Signed JWT | |
|---|---|---|
| Expiry | Never — a leaked hash impersonates forever | Bounded by exp |
Trusted profile fields | No | Yes |
| Revocation | Rotate the shared secret (affects all users) | Token self-revokes at exp |
Because the hash never expires, a leaked user_hash is a permanent impersonation risk for that user. Use signed JWTs for new integrations; reserve HMAC for migrating existing Intercom-style installs.
Logging out
Clear identity the same way as any proof — see Sessions.