Identity verification

Identity verification belongs to an agent's contact policy. It does not depend on a client-side guess about who a visitor is. Use the REST endpoints to inspect the current verification configuration, enable or disable it, and regenerate the secret when necessary. Use these same endpoints to set the contact resume window. Keep every secret-handling request in a trusted backend. After you regenerate the secret, rotate the downstream configuration.

Present verification to the user as a deliberate journey. Tell the person why the integration needs a contact method. Collect only the required information. If verification is incomplete or expired, do not merge identities automatically. Configuration changes affect future conversation behavior. They do not prove that an existing browser session belongs to a specific person.

If you need to create or export contact records, pair this guide with the Contacts REST guide. Use server-side authorization and the API's response envelope for every update. If the application also embeds chat, the browser can collect intent. The backend must apply verification policy through the documented API. Do not expose the secret to the page.