> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentictrust.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity Verification

> Verify end users with HMAC signatures or JWT tokens so the agent can access personalized data securely.

Identity verification lets you prove who a user is before the agent accesses sensitive data or performs privileged actions. Agentic Trust supports two verification methods: **HMAC** and **JWT**.

## HMAC verification

HMAC verification uses a shared secret to sign the user's ID on your backend. The widget sends the signature to Agentic Trust, which verifies it before granting access.

<Steps>
  <Step title="Generate an HMAC secret">
    Go to **Identity** in the dashboard sidebar and click **Generate Secret**. Copy the secret — it's only shown once.
  </Step>

  <Step title="Sign the user ID on your backend">
    Compute an HMAC-SHA256 signature of the user's external ID using the secret:

    <CodeGroup>
      ```javascript Node.js theme={null}
      import crypto from "crypto";

      const hmac = crypto
        .createHmac("sha256", "your_hmac_secret")
        .update("user-42")
        .digest("hex");
      ```

      ```python Python theme={null}
      import hmac
      import hashlib

      signature = hmac.new(
          b"your_hmac_secret",
          b"user-42",
          hashlib.sha256,
      ).hexdigest()
      ```

      ```ruby Ruby theme={null}
      require "openssl"

      signature = OpenSSL::HMAC.hexdigest(
        "SHA256",
        "your_hmac_secret",
        "user-42"
      )
      ```
    </CodeGroup>
  </Step>

  <Step title="Pass the signature to the widget">
    Include the user object when initializing the widget:

    ```html theme={null}
    <script>
      AgenticTrust.initAsync({
        apiUrl: "https://platform.agentictrust.com/api/v1",
        apiKey: "lum_pk_your_api_key",
        user: {
          id: "user-42",
          email: "user@example.com",
          name: "Jane Doe",
          hmac: "computed_hex_signature"
        }
      });
    </script>
    ```
  </Step>
</Steps>

## JWT verification

JWT verification uses a signed token instead of a raw HMAC. This is useful when you already issue JWTs in your application.

<Steps>
  <Step title="Generate an HMAC secret">
    Same as above — the secret is used to sign and verify JWTs (HS256 algorithm).
  </Step>

  <Step title="Issue a JWT on your backend">
    Create a JWT with the user's ID as the `sub` claim. Optionally include `email` and `name`:

    <CodeGroup>
      ```javascript Node.js theme={null}
      import jwt from "jsonwebtoken";

      const token = jwt.sign(
        { sub: "user-42", email: "user@example.com", name: "Jane Doe" },
        "your_hmac_secret",
        { algorithm: "HS256", expiresIn: "1h" }
      );
      ```

      ```python Python theme={null}
      import jwt

      token = jwt.encode(
          {"sub": "user-42", "email": "user@example.com", "name": "Jane Doe"},
          "your_hmac_secret",
          algorithm="HS256",
      )
      ```
    </CodeGroup>
  </Step>

  <Step title="Pass the token to the widget">
    Use the `identify` method or set up automatic token refresh:

    ```html theme={null}
    <script>
      // One-time identification
      AgenticTrust.identify("your_jwt_token");

      // Or auto-refresh
      AgenticTrust.setIdentityTokenFetcher(async () => {
        const res = await fetch("/api/identity-token");
        if (!res.ok) return null;
        const data = await res.json();
        return data.token;
      });
    </script>
    ```
  </Step>
</Steps>

## Choosing between HMAC and JWT

|                | HMAC                                | JWT                           |
| -------------- | ----------------------------------- | ----------------------------- |
| **Best for**   | Simple integrations                 | Apps that already use JWTs    |
| **User data**  | Passed separately (`email`, `name`) | Embedded in token claims      |
| **Expiration** | No built-in expiry                  | Token has `exp` claim         |
| **Refresh**    | Not needed                          | Use `setIdentityTokenFetcher` |

<Warning>
  Never expose your HMAC secret in client-side code. Always compute signatures and sign tokens on your backend.
</Warning>