Note: This feature is now fully available to new customers. However, for existing customers, to make sure migrating to this method goes smoothly, Please email us if you're interested in transitioning to Secure Identity Verification.

Identify Verification enforces two simple rules

It works by providing a way for Chameleon to verify the authenticity of requests made to our APIs (via a digital signature).

​Note: Although it is optional, we encourage all our customers to enable secure Identity Verification.

Identity Verification works by ensuring that the signature you generate (when sending data to Chameleon) can only have been generated by you.

The code snippet you install in your web app - and the user ID you send are not private. Therefore we provide you with a secret with which you generate a verification hash, which we check. Only you can generate this hash, which validates that no third-party is sending us a request.

Additionally, we ask that you include the current timestamp when the token was generated so that we can reject requests that are too old, or being replayed back to us, and so that we can rotate your key.

Your users' data will be more secure since one user cannot "act as" another.

It does not impact end-user experience or performance in any way. Your end-users will not notice that identity verification is on/off unless they attempt to download their or another user's data via browser console.

To do this, visit the Chameleon installation page in your web dashboard and select your preferred installation method:

When in the "Integrate Code" section, you should see a toggle on the left for "Encode User IDs" -- ensure this is ON.

Then, above the code snippet on the right, you will (partially) see the Identity Verification Secret Key.

Use this key is used to generate SHA256 HMAC signature to send alongside the User ID as part of the code installation.

You can copy this key to use, but note it should not be shared with anyone.

When using within your backend responsible for generating the hash please add an environment variable to avoid exposing the key.

Examples of how to do this for a range of languages, including Javascript, Ruby, Python, and others are below:

Identity Verification is turned on and enforced when the first verified request is received. This means that if the uid_hash being sent does not verify, Identity Verification will fail and not be enabled for your account.

Once we receive any secured data from any page where your account's Chameleon token is used, all un-verified data (sent without the signature) will be ignored by Chameleon.

This means that users identified without the verification hash will not see any Chameleon Experiences until they are securely identified.

Add the uid_hash into the call to chmln.identify.

When using plain JavaScript:

When using Twilio Segment:

You can test any domain you have installed Chameleon on and verify that secure data is being received. You can do so from the Installation section of your Chameleon Dashboard.

Any unverified requests made after the verification is enabled will return a 401 error HTTP response.

If you are making a switch from sending unsecured data to secured data, then we recommend deploying this change to production first, to enable a smooth roll-out to your users.

An alternative path is to deploy to your staging environment in off-hours and then to production as soon as possible. During the period between first verification on staging and verification on production, no Chameleon Experiences will be shown to end-users in your production environment.

Note: Once you enable Identity Verification, all REST API requests must use your Secret API key found on this page and not your account token (identifier in the installed Chameleon code snippet). Any requests using your account token will be ignored (401 error response).

Note: If you install Chameleon on a domain that's different from your email domain, it will be automatically disabled, and you should manually enable it in your Environments. The same goes for new subdomains that you add to already-enabled domains. This is to ensure better security and that no malicious domains get added to your account.

Upon receiving your first verified request, verification is turned on and enforced.

You cannot turn off Identity Verification once you have started sending us secure data. Contact us if you need assistance.

Short answer is yes. Longer answer is that because your backend generates this signature, when you login as a different user, your system will send a signature corresponding to the different user.

Yes! We're so glad you asked. We can generate a new key for you when you request it, and it'll show up on your installation page. We'll leave both keys enabled while you switch them, then contact us and we'll remove the old one.

👉 Still having trouble with Identity Verification? Please email us and we’ll be happy to take a look!