Identity verification

Agent > Identity verification is the dashboard's status snapshot for the feature the Quickstart walks you through setting up on your own server. This page covers the dashboard side only: the toggle and what it reports.

What's on the page

Identity checks, a stacked bar chart of every session that tried to identify in the last 24 hours, one bar per hour, split by outcome:

• Verified: sessions whose signature checked out.
• Verified (previous secret): sessions verified during an active Secret rotation's grace window.
• Unverified: a user id asserted with no signature at all.
• Refused: a signature that didn't check out.

The four totals for the window are repeated under the chart. Previous secret grace expires: {date} appears only while a rotation grace window is actually active.

Next to the toggle, Sign the users you identify carries the two-step recipe: sign the user id with your environment Secret on your server, then pass the result to identify(). Its wording changes with the toggle, because the cost of an unsigned call does.

There's no per-session drill-down here.

Enforce identity verification

The toggle itself, admin-only. Off is a dry run: signatures are still checked and counted above, but nothing is turned away. On, a session whose signature doesn't verify is served as anonymous rather than attributed to the user id it claimed.

What "served as anonymous" costs you

With enforcement on, an identify() call carrying no valid signature is discarded whole. Not just the user id: every attribute sent with it, including the name, the email, and the plan. No user profile is created or updated.

The call still answers 200, and the widget still greets the user by the name it was handed, because that name came from the request rather than from anything ARCY stored. So an integration with a missing signature looks healthy from the browser while storing nothing at all. Two things make it visible:

• Unverified and Refused climbing in the chart above.
• A console warning from the widget on every affected call, naming the missing userHash.

If you see users arriving as anonymous while your code clearly calls identify(), check the signature before anything else.

Rotating the Secret happens from Environments, not here; this page only shows the effect of a rotation in progress.

See also

• Enforce identity verification: the signing recipe you implement on your own server
• Environments: rotating the Secret this page verifies against