Identify visitors

Tell the Hubbo embed who is logged in so Targeting can show widgets only to identified or anonymous visitors.

Hubbo does not run your auth. After a visitor signs in on your site, call window.hubbo.identify() with your own user id (and, when Identity Verification is on, a userHash from your backend). That state is used by shared Targeting (Visitor auth: Anyone / Logged in / Logged out). Call reset() on logout.

Identity Verification (recommended)

For mid-size and enterprise installs, enable Identity Verification under Embed settings. Your server computes HMAC-SHA256(secret, userId) (hex, Intercom-compatible) and the browser passes it as userHash. Hubbo verifies the hash on the API and enforces Logged in / Logged out targeting server-side — DevTools spoofing of identify({ id }) alone is not enough.

Embed targeting, shareable pages

Visitor auth gates embed delivery. Public URLs such as /page/{key}/{id} remain shareable once someone has the link. Do not treat Targeting as a lock on those public pages.

API

// After your own login succeeds (and your backend returned userHash when IV is on)
await window.hubbo?.identify({
  id: user.id,              // required (string or number)
  userHash: user.userHash,  // required when Identity Verification is enabled
  email: user.email,        // optional
  traits: { plan: 'pro' }   // optional, local only
});

// On logout
window.hubbo?.reset();

// Read current visitor (or null)
const visitor = window.hubbo?.getVisitor();

// Node — compute userHash on your server (never ship the secret to the browser)
const crypto = require('crypto');
function hubboUserHash(userId, secret) {
  return crypto.createHmac('sha256', secret).update(String(userId)).digest('hex');
}

identify with an empty id clears identity (same as reset).
When Identity Verification is enabled, a missing or invalid userHash leaves the visitor anonymous.
Widgets re-fetch targeting after identify/reset so server-side auth filters apply.
Manage the secret in Settings → Embed → Identity Verification (show, rotate, revoke previous). Never put the secret in frontend code.
For visitor-facing translations, prefer window.hubbo.setLang() — see Set visitor language. Optional traits.locale / traits.language are used only when setLang is unset (after the browser language).

Visitor auth targeting

In the admin app, open Targeting on a notification, NPS or survey (or a saved audience) and set Visitor auth to Anyone, Logged in or Logged out.

Seen notifications targeting

The same Targeting form can require or exclude selected notification ids based on seen state. Seen means the visitor opened the notification widget (bell list) while those notifications were listed — Hubbo stamps their ids in local browser storage. It is not a click on a toast or top bar, and it is not Messages. Full guide: Seen notifications targeting.

Must have seen: every selected id must be stamped.
Must not have seen: hide if any selected id is stamped.
Both empty: rule ignored.

Install the script first: Quick start. Targeting fields are also covered in Saved audiences, NPS settings and targeting and Survey targeting and publishing.