Set up Identity Verification (Deprecated, use secure installation guide instead)

Prevent impersonation and make your Featurebase setup more secure.

Written By Robi Rohumaa

Last updated 4 days ago

Identity verification works for old installations, but for new installations, please refer to: Secure your installation (required by default)

Set up Identity Verification

Start by finding your identity verification secret from Settings → Identity Verification

Generate an HMAC code on your server

First, decide how you'd like to uniquely identify your users — by User ID or Email. You’ll then generate HMAC from the identifier signed with your secret.

import crypto from "crypto";

// Your identity verification secret
const secretKey = "iv_your-secret-key"; 

// Use email or user identifier
const userIdentifier = currentUser.email; 

// Generate HMAC hash
const userHash = crypto
    .createHmac('sha256', secretKey)
    .update(userIdentifier)
    .digest('hex');

import hmac
import hashlib

# Your identity verification secret
secret_key = "iv_your-secret-key"  

# Use email or user identifier
user_identifier = current_user.email  

# Generate HMAC hash
user_hash = hmac.new(secret_key.encode(), user_identifier.encode(), hashlib.sha256).hexdigest()

require 'openssl'

# Your identity verification secret
secret_key = "iv_your-secret-key"  

# Use email or user identifier
user_identifier = current_user.email  

# Generate HMAC hash
user_hash = OpenSSL::HMAC.hexdigest("SHA256", secret_key, user_identifier)

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;

public class HMACExample {

    public static void main(String[] args) throws Exception {
        String secretKey = "iv_your-secret-key"; // Your identity verification secret
        String userIdentifier = currentUser.getEmail(); // Use email or user identifier

        Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
        SecretKeySpec secret_key = new SecretKeySpec(secretKey.getBytes(), "HmacSHA256");
        sha256_HMAC.init(secret_key);

        byte[] hash = sha256_HMAC.doFinal(userIdentifier.getBytes(StandardCharsets.UTF_8));
        StringBuilder result = new StringBuilder();
        for (byte b : hash) {
            result.append(String.format("%02x", b));
        }
    }
}

<?php
// Your identity verification secret
$secretKey = "iv_your-secret-key";  

// Use email or user identifier
$userIdentifier = $currentUser->email;  

// Generate HMAC hash
$userHash = hash_hmac('sha256', $userIdentifier, $secretKey);
?>

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
)

func main() {
	// Your identity verification secret
	secretKey := "iv_your-secret-key"  

	// Use email or user identifier
	userIdentifier := currentUser.Email  

	// Generate HMAC hash
	h := hmac.New(sha256.New, []byte(secretKey))
	h.Write([]byte(userIdentifier))
	userHash := hex.EncodeToString(h.Sum(nil))
}

using System;
using System.Security.Cryptography;
using System.Text;

class Program
{
    static void Main()
    {
        // Your identity verification secret
        string secretKey = "iv_your-secret-key";  

        // Use email or user identifier
        string userIdentifier = currentUser.Email;  

        // Generate HMAC hash
        using (var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secretKey)))
        {
            byte[] hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(userIdentifier));
            string userHash = BitConverter.ToString(hash).Replace("-", "").ToLower();
        }
    }
}

NB! Keep your secret secure! Never store it in your repository, client-side code, or anywhere a third party could access it.

Update your code to send the HMAC

Find all places in your codebase where you’ve used the Featurebase("identify", {...}) SDK call and add the user hash there like this:

Featurebase("identify", {
  organization: "yourorg",
  "email": "user@example.com",
  ...otherFields,
  userHash: "user-hash-for-this-specific-user"
})

Optional: Company Identity Verification

You can optionally also enable identity verification for the company attribute to ensure the user is from the company they claim to be from.

Company hashes are created the same way as user hashes. Hash the company ID with your identity verification secret and pass it as a companyHash attribute to the company.

Each company you attach to a user must have a valid hash if this setting is enabled.

Featurebase("identify", {
  organization: "yourorg",
  email: "user@example.com",
  userHash: "user-hash-for-this-specific-user",
  companies: [
    {
      "id": "123",
      "companyHash": "company-hash-created-from-company-id",
      ...otherFields
    }
  ]
  ...otherFields,
})

Testing if a user hash is valid

To test if a user hash is valid:

Go to Settings → Identity Verification
Enter the User ID/Email into the Test Your Identity Verification Hash (HMAC) section
Compare if the hash your server generates matches the one displayed in the Featurebase dashboard.

Enforcing Identity Verification

If you’ve successfully updated your code to include the userHash field and encounter no errors, you can now enforce Identity Verification by toggling the checkbox in Settings → Identity Verification

Once enforced, all requests without a valid user hash will be rejected, ensuring that user impersonation is impossible.

Turning off Identity Verification

You can always disable Identity Verification by unchecking the Enforce Identity Verification checkbox in Settings → Identity Verification

Keep in mind that disabling this will open you up for user impersonation attacks.

FAQ

How do I get a new Identity Verification Secret?

It’s not possible to rotate the Identity Verification secret yourself. Please contact us via the live chat or email team@featurebase.app to request a rotation.

If you fear your identity verification secret may have been exposed, you can temporarily restrict the visibility of your organization by making it private from Settings → Privacy.

This makes everything visible to admins only and disallows user impersonation attacks.

Still need help? Ask the team