Identifica il cliente connesso (user_token)

Before AI can look up orders, it must know who the customer is. Customer identity is proven by a signature from your server; the browser cannot forge it.

The signing secret is found on the "Integrations" page in the dashboard (only the owner can see it), in the format whsec_.... It is used in both directions: you use it to sign user_token; we use it to sign the webhooks and order lookup requests we send you.

The user_token format: base64url(JSON) + "." + hex(HMAC-SHA256(signing secret, base64url(JSON)))

JSON fields:

Node.js example:

import crypto from "node:crypto"

function signUserToken(user, secret) {
  const payload = { user_id: user.id, name: user.name, email: user.email, exp: Math.floor(Date.now() / 1000) + 3600 }
  const body = Buffer.from(JSON.stringify(payload)).toString("base64url")
  const mac = crypto.createHmac("sha256", secret).update(body).digest("hex")
  return `${body}.${mac}`
}

On the page:

<script>window.AICS_USER_TOKEN = "服务器签发的 user_token"</script>
<!-- 页面加载后才登录的，调用 AICS.identify(token) -->

You can also avoid putting it in the page and instead add data-user-token-url="/your-endpoint" to the script: before the customer service widget opens a conversation, it requests this same-origin address using the customer's cookie, and it returns {"token": "user_token"} (returns {"token": null} if not logged in). Once the Yinke app is installed on a Shopify store, the chat widget automatically retrieves the identity of the logged-in customer this way, with no extra integration needed.