Identify signed-in customers (user_token)

Your server signs proof of the customer’s identity so the AI can look up orders and place orders for them.

AI can't look up orders until it knows who the customer is. Customer identity is proven by a signature from your server — the browser can't forge it.

You'll find the signing secret on the "Integration" page in the dashboard (visible only to the owner). It looks like whsec_.... It's used in both directions: you use it to sign the user_token; we use it to sign the webhooks and order lookup requests we send to you.

Format of the user_token: base64url(JSON) + "." + hex(HMAC-SHA256(signing secret, base64url(JSON)))

JSON fields:

Field	Required	Description
`user_id`	Yes	The customer ID in your system; returned to you as-is when orders are looked up
`exp`	Yes	Expiry time (Unix seconds), at most 7 days
`name` / `email`	No	Displayed in the agent workspace

Node.js example:

import crypto from "node:crypto"

function signUserToken(user, secret) {
  const payload = { user_id: user.id, name: user.name, email: user.email, exp: Math.floor(Date.now() / 1000) + 3600 }
  const body = Buffer.from(JSON.stringify(payload)).toString("base64url")
  const mac = crypto.createHmac("sha256", secret).update(body).digest("hex")
  return `${body}.${mac}`
}

In the page:

<script>window.AICS_USER_TOKEN = "服务器签发的 user_token"</script>
<!-- 页面加载后才登录的，调用 AICS.identify(token) -->

You can also keep it out of the page and add data-user-token-url="/你的地址" to the script instead: before the support widget starts a conversation, it requests that same-origin URL with the customer's cookies and expects {"token": "user_token"} back ({"token": null} if not logged in). Once a Shopify store has the Yinke app installed, the chat widget automatically identifies logged-in customers this way — no extra integration needed.

Was this page helpful?

Last updated: October 31, 2026