Skip to main content
At the end of this page, your organization has a signing key for verified identity and you can read identity status anywhere in the dashboard.

​
Before you start

Before you start, sign in to the dashboard and select the organization you want to work in.
  • Only an organization admin can open the Integrations tab or manage the signing key.
  • Your website’s server must sign identity data. Share the signing contract with your developer.

​
How verification works

Your server signs the identity data of a signed-in end user with your organization’s key. The widget sends the signed data with the conversation. Tars checks the signature and marks the profile as verified. The exact payload format and code samples live in Identity signing. When signed identity is not available, an OTP step can verify the end user inside the conversation. An AI Agent can collect an email or phone and send the OTP.

​
Manage the signing key

1

Open Settings → Integrations

Select Signing secrets, then find the Identity verification card.
2

Create the signing key

Select Generate signing key. The result shows the key ID and secret. Saved table rows mask the secret.
3

Copy the secret to your server

Select Copy to copy the secret to your clipboard. Store it in your server’s secret store.
4

Rotate the key when it may be exposed

Select Rotate key. The retiring key lists its end time and remains valid for 24 hours.
5

Remove the key to stop signed identity

Select Remove, then confirm Remove keys. Current and retiring keys stop verifying signatures immediately.
The card lists the retiring key during rotation. Another rotation is unavailable until its 24-hour overlap ends. Copy works on both keys, and each copy is audited. When signatures fail, the card counts the failed checks from the last 24 hours and names the most common reason. Admins and Auditors, who can read the audit log, get a View in audit log link. The audit log records each failure reason. See Identity signing.

​
Read identity status in the Users directory

Open Users from the sidebar. The User column shows each end user’s display name with a status line under it. To list only one status, select Filter, pick the Status attribute, and choose Anonymous or Identified. The comparison is Equals or Does not equal, then select Apply.

​
Read identity status on a profile

Select a row in the directory to open the profile. The left summary card shows the avatar, display name, and a status badge with an info tooltip. An anonymous profile promotes to Identified when a verified source supplies an email or phone. Verified sources are signed identity, an OTP step, a dashboard edit, the API, and an import. A name alone does not promote a profile. A profile you create by hand, over the API, or through an import starts as Identified. The Metadata section of the same card records Last identified, alongside First seen, Last seen, and Source. Source reads Inbound, CSV import, or Manually.

​
Edit identity fields

The center of the profile page holds the Identity card. Editing requires permission to manage end users.
1

Fill in Name, Email, or Phone

Identifier is read-only. It holds the anonymous id the widget assigned, or the channel’s id for the end user.
2

Select Save in the card header

The button enables only after a change. A Saved message confirms the update.
Adding an email or phone promotes an anonymous profile to Identified. Tars treats a dashboard edit as a verified identification. When the profile is still anonymous, the edit can merge it into an identified profile that holds the same email or phone. A save that leaves both Email and Phone empty fails.

​
How profiles merge

An anonymous profile merging into a verified profile on a verified match, moving its conversations and segment membership, while unverified browser data is blocked from overwriting the verified values.
When a verified match is found, Tars merges the anonymous profile into the identified one automatically. Conversations and segment membership move to the identified profile. Missing name, email, phone, and channel identifiers are filled in from the anonymous profile. Two identified profiles never merge automatically. Segment data moves with the segment membership. This also applies while a campaign on that segment runs or prepares its recipients.

​
Protection against identity takeover

Unverified browser data cannot overwrite a verified email or phone. A verified profile keeps those values even when an unsigned widget session claims the same identity.

​
Verify

Sign in to your website as a test end user and open the widget. The signed data must include an email or phone. In Users, the matching profile shows the Identified badge, and Metadata records Last identified.