Skip to content
mango·agentby Mangosteen Studio
Feature · Built

Signed-in users

Inside a signed-in app, call mango.identify() with a signature from your server. Visitors then get support without re-explaining who they are, and their anonymous history merges into the contact.

Know who's asking inside your app, without spoofing. Walkthrough: Customize the widget

HMAC-signed identity#

Your server signs userId:email (email lowercased) with the project's secret key using HMAC-SHA256 and passes the hex digest to the page. The backend recomputes it, so identity can't be forged from the browser.

server (Node)
import { createHmac } from "node:crypto";

const signature = createHmac("sha256", process.env.MANGO_SECRET_KEY)
  .update(`${user.id}:${user.email.toLowerCase()}`)
  .digest("hex");
browser
mango.identify({ userId: user.id, email: user.email, name: user.name, plan: user.plan, signature });