Feature
Your members are already signed in
If somebody is signed in to your site, they should be signed in to the chat. Pass us who they are, signed with your secret, and they arrive with their own name and avatar.
One signature
Your server signs the member’s id, name, avatar and profile URL with your API secret. The widget presents it; we verify it; nobody types a password twice.
Identity stays yours
We hold the identifier your site gave us, scoped to your site. Your user directory stays where it is.
Guests still work
Signed-out visitors can still read, and still join with a name, if you want them to. That is a setting, not a rebuild.
How it works
How somebody arrives already signed in
Your server signs the details
When you render a page for a logged-in user you include their id, name and picture, plus a signature made with your secret key. The key itself never reaches the browser.
The widget presents them
It hands that signed block to the API, which checks the signature against the key you hold. A block that does not verify is refused, so the name beside a message cannot be chosen by whoever is sitting at the keyboard.
They are themselves everywhere
The same person on a phone and a laptop is one member with one history, because the identity came from your system rather than from a nickname typed into a box.
Nobody registers twice
No second account, no confirmation email, no extra password to forget. The account they already have on your site is the one they use in the chat.
Questions
- What do I have to build?
- A few lines where you render the page: assemble the user details, sign them with your key, pass them to the widget. Nothing to install and no callback for us to make — the signing happens on your side, in whatever language your site is already written in.
- Could somebody impersonate another user?
- Not with signature checking on, which is the setting that makes this worth doing. The signature is made with a key only your server holds, so a browser cannot produce a valid one for a name it was not given.
- Do signed-out visitors still work?
- If you want them to. Guests can still read and join with a name, or you can require identification and show nothing to anyone signed out. It is a setting rather than a rebuild.
- Which plans include single sign-on?
- All of them, including the entry plan. It is how most sites of any size actually run the chat, so putting it behind a higher tier would only produce sites running worse than they need to.
Put a chat on your site this afternoon
One script tag before the closing body tag. Fourteen days free, and no card until you decide.