Identity verification helps to make sure that conversations between you and your users are kept private and that one user can't impersonate another. We strongly encourage all Intercom customers to set up and enable identity verification.
Follow these instructions in your Intercom Setup Guide to set up and enable Identity verification on your web product.
How does identity verification work?
The purpose of identity verification is to verify that your users are who they claim to be. It works by using a server side generated HMAC (hash based message authentication code), using SHA256, on either your user’s email or user_id. Once identity verification is enabled, Intercom will not accept any requests for a logged-in user without a valid HMAC.
Do I need identity verification?
In the interest of protecting your users’ data and conversations, we recommend that everyone enables identity verification. If you only talk to anonymous visitors or don’t use the Intercom Messenger, you can skip the identity verification setup, but we still encourage you to enable it in the Intercom for web settings. This helps prevent third parties from performing malicious actions.
Important: It's not possible to set up identity verification for logged-out visitors/leads.
Does the Messenger change with identity verification?
No, once identity verification is set up correctly, your users will experience the Messenger as normal.
Can I turn off identity verification?
You can turn identity verification on or off at any time in the Intercom for web settings. This can be useful while you’re developing but your app will be vulnerable while it’s off. This means someone with your app’s id could impersonate as one of your users and see their conversations, modify their data in Intercom, or pretend to be an important customer.
How do I know if identity verification is working?
To verify that you’ve set up and enabled identity verification correctly, visit any page on your web app or site with Intercom Messenger and click the Messenger icon. If you've enabled identity verification in the the Intercom for web settings and Messenger loads successfully when you click on it, then identity verification is working. If identity verification is not enabled or the Messenger does not load successfully, check the errors in your browser's console window to find out why.
If you run into any problems while enabling identity verification, take a look at our troubleshooting doc or just let us know - we're always here to help.