Identity (JWT) Signing Secret

The Identity (JWT) Signing Secret is the shared secret used to sign JWTs for widget.identify. It appears in the dashboard as Identity (JWT) Signing Secret.

Where to find it

Open your agent in the dashboard and navigate to:

Agent Settings → Website Integration → Backend Token Generation

Keep it server-side

• Never expose the secret in frontend code.
• Store it in your server environment (for example CHATBYTE_WIDGET_AGENT_SECRET). The legacy CHATBYTE_BIT_AGENT_SECRET name remains supported during migration.
• Rotate it only when you are ready to update all signing logic.

Signing example (Node.js)

import jwt from 'jsonwebtoken';

const secret = process.env.CHATBYTE_WIDGET_AGENT_SECRET;

const token = jwt.sign(
  {
    sub: 'user-123',
    email: 'alice@example.com',
    name: 'Alice Smith',
    fields: {
      plan: { value: 'pro' },
      role: { value: 'admin', description: 'Workspace admin' },
    },
    aud: 'chatbyte',
  },
  secret,
  {
    algorithm: 'HS256',
    expiresIn: '10m',
  },
);

Troubleshooting

• Tokens with expiry longer than 10 minutes are rejected.
• Tokens signed with algorithms other than HS256 are rejected.
• If identity fails, verify the secret matches the dashboard value.