User Verification in Enhanced Web Chat

To learn about and set up User Verification, see User Verification in Salesforce Help.

Configure your web client so you can personalize and secure the conversation between a verified user and a rep. See the Enhanced Web Chat Event Listeners reference for details.

1. Add event listeners for onEmbeddedMessagingReady and onEmbeddedMessagingIdentityTokenExpired to your website’s code or to the Code Snippet. See Get started With APIs for Enhanced Web Chat.

   When you receive an onEmbeddedMessagingReady event, the API is ready for requests.

2. After you receive an onEmbeddedMessagingReady event, pass your identity token to the API by using the setIdentityToken method.

   Create the identity token and set its expiration time with the authorization mechanism of your choice.

   Call this method for every tab or window where you want the user to have an authenticated conversation. Because the identity token is stored in the browser’s memory, you must call this method after a page refresh. JWTs must be signed using the RS256 or RS512 algorithms.

   The conversation button is rendered after the API receives a valid identity token. The API generates a Salesforce authorization token when the user clicks the button, and the session starts.

   The Salesforce token has a separate expiration time, determining how long the session stays active. You can edit this expiration time in Messaging Settings in Setup in the Authorization Token Expiration Time for Verified Users field. The default is 60 minutes.

3. If you interact with the web client after both the Salesforce token and the identity token have expired, the client dispatches the onEmbeddedMessagingIdentityTokenExpired event, but you can keep the session active. To keep the session active, send a new identity token to the API within 30 seconds of the onEmbeddedMessagingIdentityTokenExpired event by using the setIdentityToken method as before.

4. When the user logs out, call the clearSession method. This method clears all messaging and user data from all tabs and windows.

   You don’t have to call the clearSession method. When the client doesn’t receive a new identity token within 30 seconds of dispatching the onEmbeddedMessagingIdentityTokenExpired event, the client clears the session.

5. Listen for the onEmbeddedMessagingReady event again to know when the API is ready for another conversation.

By default, when a verified user returns to a page that has the web client, the client automatically resumes their existing conversation by using the access token stored in the browser’s local storage. This behavior is called session continuity.

To pause session continuity, set pauseSessionContinuity to true. When you pause session continuity, the client doesn’t automatically resume an existing conversation when the page loads. Instead, your host page controls when to resume the conversation by calling the setIdentityToken method. Use this setting when you want to confirm that a user is still authenticated on your site before you resume their conversation. For example, use it to prevent a conversation from resuming after a user logs out.

Add this setting to your deployment’s code snippet. The pauseSessionContinuity setting applies only to token-based user verification. The default is false.

This sample code shows how to implement the key steps that verify a user for a messaging conversation. To determine where to add this code to your web page, see Get started With APIs for Enhanced Web Chat. For more code snippet settings, see the settings reference documentation.