Security and Authentication Examples

This guide provides everything you need to integrate the Verba AI Chat widget securely into your application using JSON Web Tokens (JWT) for authenticated sessions.

How It Works

The following diagram illustrates the full integration flow between your frontend, your backend, the Verba Chat SDK, and the Verba backend.

Responsibilities

What Your Team Needs to Do:

• Sign a JWT token: Generate a token per logged-in user using the shared secret key provided by Verba.
• Pass the token: Provide that token to the SDK on initialization.

What the SDK Handles:

• Renders Chat UI: Injects an iframe into your target element automatically.
• Secure Communication: Manages all messaging and authentication directly with the Verba backend.
• Data Integration: The Verba backend handles connections to your data source to query information when needed.

Authenticated Sessions

Authenticated sessions identify individual users and allow for personalized experiences and thread history.

How Token Signing Works

Verba provides your organization with a unique secret key. This key must be stored securely on your backend and used to sign JWT tokens for your users. Never expose the secret key on the frontend.

JWT Payload Requirements

The payload must include a sub (subject) claim representing the unique identifier of your user:

{
    "sub": "user_123456789"
}

Backend Implementation Example (Node.js)

Here is a simple example of how to generate the token on your server:

import jwt from 'jsonwebtoken'

// Run this on your backend for each logged-in user
const signUserToken = (userId) => {
    const token = jwt.sign({ sub: userId }, process.env.VERBA_SECRET_KEY)
    return token
}

// Pass the 'token' to your frontend to initialize VerbaChat

Best Practices

• Secret Management: Store VERBA_SECRET_KEY as an environment variable and never commit it to version control.
• Security Service: Always generate tokens on the server-side. Client-side signing is a major security risk.
• Token Delivery: Ensure your backend only provides tokens to authorized, logged-in users after their local session is verified.