Verifying identified users

Unsigned identify() is enough for targeting and best-effort deduplication. Sign it when Palette must trust that the ID belongs to a user authenticated by your server — for example for rewards or a durable user panel. In Workspace settings, Recruit, generate an identity signing secret and copy it into a server-only PALETTE_RECRUIT_SECRET environment variable. Do not expose it through browser JavaScript or a public environment-variable prefix.

Sign on your server

Sign the exact user ID you will send. The expiry is Unix seconds and must be no more than 15 minutes ahead; ten minutes is recommended.

import { createHmac } from "node:crypto";

function signPaletteIdentity(userId) {
  const normalized = String(userId).normalize("NFC");
  const expiry = Math.floor(Date.now() / 1000) + 600;
  const signature = createHmac("sha256", process.env.PALETTE_RECRUIT_SECRET)
    .update(`${normalized}.${expiry}`, "utf8")
    .digest("hex");
  return { userId: normalized, signature, expiry };
}

Pass the result to the snippet

Return only the user ID, signature, and expiry to the authenticated page, then supply the signature options as the fourth argument.

window.Palette = window.Palette || [];
window.Palette.push([
  "identify",
  signedIdentity.userId,
  { plan: currentUser.plan, role: currentUser.role },
  { signature: signedIdentity.signature, expiry: signedIdentity.expiry },
]);

Reset on logout or account change

Palette cannot observe your app's authentication state. Call reset after logout succeeds and before identifying another user. The next login should call signed identify again. Reset clears the current browser identity, traits, and signed claim; it does not delete earlier responses.

// Run after logout succeeds and before identifying another user.
window.Palette = window.Palette || [];
window.Palette.push(["reset"]);

• The signature is lowercase-hex HMAC-SHA256 over NFC(userId).expiry.
• Generate a fresh signature per page load or identify call. Palette allows 60 seconds of clock skew.
• A signature proves the user ID, not browser-supplied trait values. Do not authorize sensitive actions from traits.
• During rotation, both the new and previous secret work. Retire the previous secret after your deployment has completed.