> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clariodesk.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verified identity

> Secure cross-device customer continuity with host tokens or a pinned OIDC provider.

<Warning>
  Verified identity is implemented but release-gated. Enable it only for a
  controlled staging app until your ClarioDesk rollout contact confirms the
  production gates are complete.
</Warning>

By default, a ClarioDesk device key authenticates one installation and
`identify({ externalId, … })` is an unverified label. Verified identity adds a
cryptographic proof so multiple devices with the same proven `(issuer, sub)`
share one canonical customer and ticket history.

## Choose an assurance mode

* **Host token (recommended for apps with a backend):** your authenticated
  backend mints a short-lived HS256 or ES256 JWT. The default profile binds it
  to `ClarioDesk.deviceThumbprint` through `cnf.jkt`.
* **OIDC:** ClarioDesk verifies a pinned Firebase, Supabase, Auth0, Clerk, or
  custom OIDC profile. These proofs are bearer assurance, so access expires
  with a short lease and the SDK re-verifies.

The dashboard mode selects the verifier. Token headers never select a provider.
Mode, issuer, audience, and the meaning of `sub` lock after first verified use.

## Lifecycle

```text theme={null}
session restore/login → verified identify(token)
logout/switch         → clearIdentity() before changing host user
remove this install   → reset() (acknowledged device revoke)
delete the customer   → Dashboard customer erase
```

An invalid token never falls back to a label write. The SDK quarantines the
old identity epoch and private work remains suspended until a valid identify or
clear succeeds.

## Host-token claims

Use a stable opaque user ID—not email—as `sub`. Include exact `iss`, `aud`,
`iat`, `exp`, unique `jti`, and the RFC 7638 device thumbprint:

```json theme={null}
{
  "iss": "clariodesk-identity",
  "aud": "your-app-id",
  "sub": "usr_123",
  "iat": 1784700000,
  "exp": 1784703600,
  "jti": "unique-token-id",
  "cnf": { "jkt": "device-thumbprint" }
}
```

The token endpoint must authenticate the host session, derive `sub` from that
session, validate the submitted thumbprint, use CSRF protection where needed,
and rate-limit requests. Never ship the identity secret in an app or browser.

## Browser origins

Browser registration is disabled until an owner/admin adds exact origins to
Dashboard → App → Settings → API keys. Wildcards are not supported. Every web
device is pinned to its registration origin on all signed requests.

<Note>
  `reset()` is not logout or account deletion. Normal logout uses
  `clearIdentity()` so the device key survives and ordered account switching stays
  safe.
</Note>