Identity verification
Sign a short-lived JWT on your server for each signed-in user. Gripz checks it before it attaches a conversation to a contact, so nobody can read another person's history by guessing an ID.
Sign the token on your server
Use HS256 and the identity secret from Settings, Security, Identity verification. Never ship the secret to the browser.
import jwt from 'jsonwebtoken';
export function gripzToken(user) {
return jwt.sign(
{ sub: user.id, email: user.email, workspace: 'tw_8f2k' },
process.env.GRIPZ_IDENTITY_SECRET,
{ algorithm: 'HS256', expiresIn: '10m' }
);
}Required claims
| sub | The same value you pass as user.id. |
|---|---|
| workspace | Your workspace ID. A token signed for one workspace is rejected by another. |
| exp | Expiry, at most 60 minutes after iat. We recommend 10 minutes. |
Check a token
Paste a token to see what Gripz would decide and why. Decoding runs in your browser and the token is not stored.
Gripz would reject this token
It expired 14 minutes ago. Sign a new one for each page load.
Decoded claims
{
"sub": "usr_4821",
"email": "elena@brightloop.studio",
"workspace": "tw_8f2k",
"iat": 1790950080,
"exp": 1790950680
}- PassAlgorithm is HS256
- Passsub is present: usr_4821
- Passworkspace matches tw_8f2k
- Failexp was 14:18 UTC today. It is now 14:32.
- SkippedSignature. Sign in to check it against your identity secret.