Identity Signing (JS)

The backend must generate a userHash by signing the user's External ID with the application's Secret Key. This page provides JavaScript implementation examples.

Specification

Parameter	Value
Algorithm	HMAC-SHA256
Key	secretKey (App Secret)
Message	externalUserId (User ID)
Output format	Hexadecimal

Node.js

const crypto = require('crypto');

function generateUserHash(secretKey, userId) {
  return crypto
    .createHmac('sha256', secretKey)
    .update(userId)
    .digest('hex');
}

// Usage
const hash = generateUserHash('your_secret_key', 'user_123');

Server runtimes with Web Crypto

Security warning

The secretKey must never be exposed in a browser, mobile app, desktop client, repository, log, or analytics event. Use this example only in a trusted server runtime that implements the Web Crypto API.

async function generateUserHash(secretKey, userId) {
  const enc = new TextEncoder();
  const key = await crypto.subtle.importKey(
    'raw',
    enc.encode(secretKey),
    { name: 'HMAC', hash: 'SHA-256' },
    false,
    ['sign']
  );

  const signature = await crypto.subtle.sign('HMAC', key, enc.encode(userId));

  return Array.from(new Uint8Array(signature))
    .map(b => b.toString(16).padStart(2, '0'))
    .join('');
}