Know which customer is chatting.
When a customer is signed in on your site, pass their id to the widget with a signature only your server can make. Nova then knows who it is talking to, keeps their history across devices, and your MCP tools can look up that customer’s own orders.
Create the identity secret on the Install page in the portal. On your server, sign the customer id as text with HMAC-SHA256 and that secret, and pass the hex result as userHash. Nova ignores an id without a valid signature.
Set kockatoosSettings before the widget script, or call kockatoosChat.identify() once it loads, and call logout() when the customer signs out. A customer access token is optional and is only ever sent to your MCP server. Never print one into HTML that a cache might serve to other visitors.
Read the full guide for owners and developers
window.kockatoosSettings = {
identity: {
userId: '42',
userHash: 'HMAC_SHA256_OF_THE_ID',
name: 'Jane Doe',
email: 'jane@example.com',
token: 'CUSTOMER_ACCESS_TOKEN', // optional
attributes: { plan: 'gold' },
},
};
window.kockatoosChat.logout(); // on sign-out
// PHP
hash_hmac('sha256', (string) $customer->id, $identitySecret);
// Node
crypto.createHmac('sha256', identitySecret).update(String(customer.id)).digest('hex');
{% comment %} Shopify Liquid, inside {% if customer %} {% endcomment %}
{{ customer.id | hmac_sha256: 'YOUR_IDENTITY_SECRET' }}