Verified identity is implemented but release-gated. Enable it only for a
controlled staging app until your ClarioDesk rollout contact confirms the
production gates are complete.
identify({ externalId, … }) is an unverified label. Verified identity adds a
cryptographic proof so multiple devices with the same proven (issuer, sub)
share one canonical customer and ticket history.
Choose an assurance mode
- Host token (recommended for apps with a backend): your authenticated
backend mints a short-lived HS256 or ES256 JWT. The default profile binds it
to
ClarioDesk.deviceThumbprint through cnf.jkt.
- OIDC: ClarioDesk verifies a pinned Firebase, Supabase, Auth0, Clerk, or
custom OIDC profile. These proofs are bearer assurance, so access expires
with a short lease and the SDK re-verifies.
The dashboard mode selects the verifier. Token headers never select a provider.
Mode, issuer, audience, and the meaning of sub lock after first verified use.
Lifecycle
An invalid token never falls back to a label write. The SDK quarantines the
old identity epoch and private work remains suspended until a valid identify or
clear succeeds.
Host-token claims
Use a stable opaque user ID—not email—as sub. Include exact iss, aud,
iat, exp, unique jti, and the RFC 7638 device thumbprint:
The token endpoint must authenticate the host session, derive sub from that
session, validate the submitted thumbprint, use CSRF protection where needed,
and rate-limit requests. Never ship the identity secret in an app or browser.
Browser origins
Browser registration is disabled until an owner/admin adds exact origins to
Dashboard → App → Settings → API keys. Wildcards are not supported. Every web
device is pinned to its registration origin on all signed requests.
reset() is not logout or account deletion. Normal logout uses
clearIdentity() so the device key survives and ordered account switching stays
safe.
