---
schema_version: "1"
id: 7b02954af1c870d99b058ea603ccd6390cbc4b0ea41def584906d7b74ff3b629
title: Understanding Token-Based User Verification
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/user_verification_overview.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.user_verification_overview.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 69a9371042edf87696d89ea6a115dfb47a8f0c726ac92bb041b8432598f10192
description: When setting up your Enhanced Chat implementation, it’s often valuable for your service reps to know that they’re speaking to a customer, or prospective customer, who has been verified by your authentication system. Token-based user verification lets you continue a conversation with a verified user, even when they’re on a different device, or when they reach out at a later time. The User Verification method uses a token system to ensure that the rep is speaking to someone who has been verified.
products:
  - Service Cloud
  - Digital Engagement
release: "264"
---
# Understanding Token-Based User Verification

When setting up your Enhanced Chat implementation, it’s often valuable for your service reps to know that they’re speaking to a customer, or prospective customer, who has been verified by your authentication system. Token-based user verification lets you continue a conversation with a verified user, even when they’re on a different device, or when they reach out at a later time. The User Verification method uses a token system to ensure that the rep is speaking to someone who has been verified.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" colspan="2" style="vertical-align:top;"><a href="https://help.salesforce.com/s/articleView?id=service.messaging_editions.htm&amp;type=5&amp;language=en_US" target="_blank">View supported editions.</a></td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <a name="user_verification_overview__d712e335"><!-- --></a><span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" id="user_verification_overview__d712e335" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/resources-global/_corporate/images/checkmark.png" alt="Checkmark"></span>
            <strong>This article applies to:</strong>
          </td>

          <td class="slds-cell-wrap" style="vertical-align:top;">Enhanced In-App Chat and Enhanced Web Chat channels</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/resources-global/_corporate/images/crossmark.png" alt="X icon"></span>
            <strong>This article doesn’t apply to:</strong>
          </td>

          <td class="slds-cell-wrap" style="vertical-align:top;">Enhanced WhatsApp, Enhanced Facebook Messenger, Standard and Enhanced SMS,
            Enhanced Apple Messages for Business, Enhanced LINE, and Bring Your Own
            Channel</td>

        </tr>
      </tbody>
    </table>

In this article, we show how you can use a JSON Web Key Set (JWKS) and a JSON Web Token (JWT) to verify your users. If you don’t have an authentication system already in place, we show how you can test token-based user verification to see if it’s right for you.

For this feature, a JWT is used as an access token for a user. A JWKS is used to verify the validity of that token. To learn more about JSON, JWT, and JWKS, see [User Verification Terms](https://help.salesforce.com/s/articleView?id=service.user_verification_terms.htm&release=264.0.0&type=5 "To set up User Verification, you must be familiar with tokens, keys, and keysets. These terms describe the fundamental concepts associated with this feature. If you want more context, this article breaks down the terms to understand.").

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/images/icon_note.png)

Note This documentation assumes that you already set up Enhanced Chat. To learn more, see [Add Flexibility and Power with Enhanced Chat](https://help.salesforce.com/s/articleView?id=service.miaw_intro_landing.htm&release=264.0.0&type=5 "Start a conversation with customers on your mobile app or website. Enhanced Chat delivers enhanced pre-chat support to pinpoint customer needs and access records before the service rep connects in the Service Console. Custom branding and mobile push notifications provide a modern experience.").

## Set Up Keys in Salesforce

When [setting up user verification in Salesforce Setup](https://help.salesforce.com/s/articleView?id=service.miaw_token_based_user_verification_setup.htm&release=264.0.0&type=5 "Let customers have secure conversations with token-based user verification. Add keys or an Endpoint URL to create a keyset, and then turn on user verification in Setup."), you can upload JSON Web Keys (JWK), or you can provide an endpoint that delivers this same information to Salesforce. This decision determines how Salesforce attempts to access your keyset when verifying your token. The user experience is the same for either flow.

![User verification keys](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/support_channels/images/miaw/miaw_user_verification_keys.png)

Other details about the key: We require a 2048-bit minimum RSA key length. Also, the \`n\` (modulus) and \`e\` (exponent) properties of the JWK should be Base64 URL encoded.

If you already have an endpoint or a keyset using your existing certificate, follow the instructions in [Set Up Token-Based User Verification](https://help.salesforce.com/s/articleView?id=service.miaw_token_based_user_verification_setup.htm&release=264.0.0&type=5 "Let customers have secure conversations with token-based user verification. Add keys or an Endpoint URL to create a keyset, and then turn on user verification in Setup.").

If you want to test this feature by creating a certificate, a key, and a token, see our [GitHub repository](https://github.com/Salesforce-Async-Messaging/key-command-line-utility). This repo walks you through creating a test certificate, creating a JWK, and creating a JWT. After you have a JWK and JWT, follow the instructions in [Set Up Token-Based User Verification](https://help.salesforce.com/s/articleView?id=service.miaw_token_based_user_verification_setup.htm&release=264.0.0&type=5 "Let customers have secure conversations with token-based user verification. Add keys or an Endpoint URL to create a keyset, and then turn on user verification in Setup.").

## Pass Token Information When the Customer Logs In

In addition to providing the key set in Setup, you must pass user verification token information to Salesforce during the login process. When you pass the token to Salesforce, your Salesforce org verifies this information with the keys that you provided earlier.

![User verification token](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/support_channels/images/miaw/miaw_user_verification_token.png)

After Salesforce verifies the token with the keyset, the verified user can have a conversation with a service rep and all message history is associated with that user.

Other details about the token: The “sub” value in the JWT is stored as part of the Messaging Platform Key field of the [Messaging End User](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_messagingenduser.htm) record. For instance, if the “sub” value is `user-123`, the Messaging Platform Key might be `v2/iamessage/AUTH/{auth_id_info}/uid:user-123`.

To learn how to use our API to pass a token, refer to our developer documentation for User Verification ([Web](https://developer.salesforce.com/docs/service/messaging-web/guide/user-verification.html), [iOS](https://developer.salesforce.com/docs/service/messaging-in-app/guide/ios-user-verification.html), [Android](https://developer.salesforce.com/docs/service/messaging-in-app/guide/android-user-verification.html)).

If you need help creating a token, use the command-line tool in our [GitHub repository](https://github.com/Salesforce-Async-Messaging/key-command-line-utility).

## Handle Cleanup After Logout

When the user logs out of your system, call the API to clear the session. This call clears any session data and revokes the token.

![User verification clear session](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/support_channels/images/miaw/miaw_user_verification_clear.png)

To learn how to use our API to clear the session, refer to our developer documentation for User Verification ([Web](https://developer.salesforce.com/docs/service/messaging-web/guide/user-verification.html), [iOS](https://developer.salesforce.com/docs/service/messaging-in-app/guide/ios-user-verification.html), [Android](https://developer.salesforce.com/docs/service/messaging-in-app/guide/android-user-verification.html)).

## Final Thoughts

Token-based user verification takes some time to set up. But when you have the mechanism in place, you ensure that your customers can have a secure, verified conversation with one of your skilled service reps.

#### See Also

- [Add Flexibility and Power with Enhanced Chat](https://help.salesforce.com/s/articleView?id=service.miaw_intro_landing.htm&release=264.0.0&type=5 "Start a conversation with customers on your mobile app or website. Enhanced Chat delivers enhanced pre-chat support to pinpoint customer needs and access records before the service rep connects in the Service Console. Custom branding and mobile push notifications provide a modern experience.")
- [Set Up Token-Based User Verification](https://help.salesforce.com/s/articleView?id=service.miaw_token_based_user_verification_setup.htm&release=264.0.0&type=5 "Let customers have secure conversations with token-based user verification. Add keys or an Endpoint URL to create a keyset, and then turn on user verification in Setup.")
- [User Verification Terms](https://help.salesforce.com/s/articleView?id=service.user_verification_terms.htm&release=264.0.0&type=5 "To set up User Verification, you must be familiar with tokens, keys, and keysets. These terms describe the fundamental concepts associated with this feature. If you want more context, this article breaks down the terms to understand.")
- [Troubleshooting User Verification](https://help.salesforce.com/s/articleView?id=service.user_verification_troubleshooting.htm&release=264.0.0&type=5 "Use these troubleshooting tips to diagnose issues with User Verification.")
- [GitHub: Key and Token Command-Line Utility](https://github.com/Salesforce-Async-Messaging/key-command-line-utility)
- [Enhanced Web Chat Developer Guide](https://developer.salesforce.com/docs/service/messaging-web/guide/introduction.html)
- [Enhanced In-App Chat Developer Guide](https://developer.salesforce.com/docs/service/messaging-in-app/guide/introduction.html)