Identify

Anonymous visitors do not need identify. After someone signs in to your site, identify links that visitor to a customer id you already have. Cusu then shows that customer's threads instead of the anonymous history. On sign-out, start a new visitor so the next person does not inherit those threads.

The browser call is identify on the web SDK. The signature is produced on your server with identifySign from @cusuai/node.

What you send

identify takes your customer id plus optional traits:

Extra string traits can ride along. They are not part of the signature.

Unsigned and signed

Until the group has an identify secret, you can call identify from the browser with the id and traits. No signature is required.

Once the secret is set, Cusu rejects unsigned identify. Sign on the backend. Take externalId and traits from the logged-in session, not from the request body. The only value that should come from the browser is visitorId, the cusu_vid cookie.

The visitor id is readable from JavaScript (SameSite=Lax). Your page posts it to your own route. That route returns the signed payload, and the page passes it to identify.

Canonical payload

The signature is HMAC-SHA256 over this text, UTF-8, keyed with isk_…. Empty optional fields are empty lines. The hex digest is signature.

v1
{visitorId}
{externalId}
{signedAt}
{name}
{email}
{phone}
{gender}

Cusu accepts the signature for about five minutes around signedAt. @cusuai/node fills signedAt with the current time when you omit it.