---
schema_version: "1"
id: 4a6a6043af61932edd9b2ed4126ef3fa63ebb10737db5422a18a904ce6b0eb68
title: User Verification in Enhanced Web Chat
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/service-cloud/messaging-web/guides/user-verification.md
canonical_url: https://developer.salesforce.com/docs/service/messaging-web/guide/user-verification.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: f99ce2d39d44b18798a80d812c6a3dbdb3eaf5ac589b08db907b44b79487cac0
products:
  - Enhanced Web Chat
  - Service Cloud Developer Content
---
# User Verification in Enhanced Web Chat

To learn about and set up User Verification, see [User Verification in Salesforce Help](https://help.salesforce.com/s/articleView?id=service.user_verification.htm).

## Configure Your Web Client

Configure your web client so you can personalize and secure the conversation between a verified user and a rep. See the Enhanced Web Chat [Event Listeners reference](/docs/service/messaging-web/guide/event-listeners.html) for details.

1.  Add event listeners for [`onEmbeddedMessagingReady`](/docs/service/messaging-web/guide/event-listeners.html) and [`onEmbeddedMessagingIdentityTokenExpired`](/docs/service/messaging-web/guide/event-listeners.html) to your website’s code or to the Code Snippet. See [Get started With APIs for Enhanced Web Chat](/docs/service/messaging-web/guide/api-overview.html).

    ```javascript
    window.addEventListener("onEmbeddedMessagingReady", () => {
      console.log("Received the onEmbeddedMessagingReady event.");

      //Add more code here.
    });
    window.addEventListener("onEmbeddedMessagingIdentityTokenExpired", () => {
      console.log("Received the onEmbeddedMessagingIdentityTokenExpired event.");

      //Add more code here.
    });
    ```

    When you receive an `onEmbeddedMessagingReady` event, the API is ready for requests.

2.  After you receive an `onEmbeddedMessagingReady` event, pass your identity token to the API by using the [`setIdentityToken`](/docs/service/messaging-web/references/m4w-reference/userVerificationAPI.html#setidentitytokenparameters) method.

    Create the identity token and set its expiration time with the authorization mechanism of your choice.

    Call this method for every tab or window where you want the user to have an authenticated conversation. Because the identity token is stored in the browser’s memory, you must call this method after a page refresh. JWTs must be signed using the RS256 or RS512 algorithms.

    ```javascript
    window.addEventListener("onEmbeddedMessagingReady", () => {
      console.log("Received the onEmbeddedMessagingReady event.");

      // Send your identity token to Salesforce
      embeddedservice_bootstrap.userVerificationAPI.setIdentityToken({
        identityTokenType: "JWT",
        identityToken: customer_signed_jwt,
      });
    });
    ```

    The conversation button is rendered after the API receives a valid identity token. The API generates a Salesforce authorization token when the user clicks the button, and the session starts.

    The Salesforce token has a separate expiration time, determining how long the session stays active. You can edit this expiration time in **Messaging Settings** in Setup in the **Authorization Token Expiration Time for Verified Users** field. The default is 60 minutes.

3.  If you interact with the web client after both the Salesforce token and the identity token have expired, the client dispatches the `onEmbeddedMessagingIdentityTokenExpired` event, but you can keep the session active. To keep the session active, send a new identity token to the API within 30 seconds of the `onEmbeddedMessagingIdentityTokenExpired` event by using the `setIdentityToken` method as before.

    ```javascript
    window.addEventListener("onEmbeddedMessagingIdentityTokenExpired", () => {
      console.log("Received the onEmbeddedMessagingIdentityTokenExpired event.");

      // Refresh the identity token and send it to Salesforce.
      embeddedservice_bootstrap.userVerificationAPI.setIdentityToken({
        identityTokenType: "JWT",
        identityToken: refreshed_jwt,
      });
    });
    ```

4.  When the user logs out, call the [`clearSession`](/docs/service/messaging-web/references/m4w-reference/userVerificationAPI.html#clearsession) method. This method clears all messaging and user data from all tabs and windows.

    **tip:** You don't have to call the `clearSession` method. When the client doesn’t receive a new identity token within 30 seconds of dispatching the `onEmbeddedMessagingIdentityTokenExpired` event, the client clears the session.

    ```javascript
    embeddedservice_bootstrap.userVerificationAPI
      .clearSession(true)
      .then(() => {
        // TO DO: Handle success
      })
      .catch((error) => {
        // TO DO: Handle error
      })
      .finally(() => {
        // TO DO: Handle regardless of result
      });
    ```

5.  Listen for the `onEmbeddedMessagingReady` event again to know when the API is ready for another conversation.

## Pause Session Continuity

By default, when a verified user returns to a page that has the web client, the client automatically resumes their existing conversation by using the access token stored in the browser's local storage. This behavior is called session continuity.

To pause session continuity, set `pauseSessionContinuity` to `true`. When you pause session continuity, the client doesn't automatically resume an existing conversation when the page loads. Instead, your host page controls when to resume the conversation by calling the [`setIdentityToken`](/docs/service/messaging-web/references/m4w-reference/userVerificationAPI.html#setidentitytokenparameters) method. Use this setting when you want to confirm that a user is still authenticated on your site before you resume their conversation. For example, use it to prevent a conversation from resuming after a user logs out.

Add this setting to your deployment's code snippet. The `pauseSessionContinuity` setting applies only to token-based user verification. The default is `false`.

```javascript
embeddedservice_bootstrap.settings.pauseSessionContinuity = true;
```

**note:** The `pauseSessionContinuity` setting takes effect only when the web client loads or initializes, which is when an access token is present in local storage. After your host page resumes the conversation by calling `setIdentityToken`, the session continues even while `pauseSessionContinuity` remains set to `true`. To pause session continuity again, the client must load again, which typically happens when the user opens the chat in a new browser tab.

## Sample Code

This sample code shows how to implement the key steps that verify a user for a messaging conversation. To determine where to add this code to your web page, see [Get started With APIs for Enhanced Web Chat](/docs/service/messaging-web/guide/api-overview.html.html). For more code snippet settings, see the [settings](/docs/service/messaging-web/references/m4w-reference/settingsAPI.html) reference documentation.

**important:** Call `setIdentityToken` for every tab or window where you want access to the authorized messaging conversation. Call `clearSession` when the user logs out.

```javascript
window.addEventListener("onEmbeddedMessagingReady", () => {
  console.log("Received the onEmbeddedMessagingReady event.");

  // Send your identity token to Salesforce.
  embeddedservice_bootstrap.userVerificationAPI.setIdentityToken({
    identityTokenType: "JWT",
    identityToken: customer_signed_jwt
  });
});

window.addEventListener("onEmbeddedMessagingIdentityTokenExpired", () => {
  console.log("Received the onEmbeddedMessagingIdentityTokenExpired event.");

  // Refresh the identity token and send it to Salesforce.
  embeddedservice_bootstrap.userVerificationAPI.setIdentityToken({
    identityTokenType: "JWT",
    identityToken: refreshed_jwt
  });

  // Or, instead of refreshing the identity token, clear all session data
  // by calling clearSession.
  // embeddedservice_bootstrap.userVerificationAPI.clearSession(true)
});

// When the user logs out, call clearSession.
function onUserLogout() {
  embeddedservice_bootstrap.userVerificationAPI
    .clearSession(true)
    .then(() => {
      // Add actions to run after the session is cleared successfully.
    })
    .catch((error) => {
      // Add actions to run after clearing the session fails.
    })
    .finally(() => {
      // Add actions to run whether the chat client launches
      // successfully or not.
    });

  // Add code to perform any other logout actions.
}
```

**note:** If your Enhanced Web Chat deployment is on an Experience Cloud site, follow the instructions in _Salesforce Help_ to add JavaScript code to the head markup section of your site. See [Configure an Enhanced Web Chat Deployment in an Experience Builder Site](https://help.salesforce.com/s/articleView?id=service.miaw_deployment_experience_builder.htm) in _Salesforce Help_.