Signed user ids

The problem it solves#

The app key is public. Without more, anyone who finds it could claim to be victim@shop.com and attach a device to that person, or send them messages meant for someone else's account.

How it works#

With Require signed user ids on, every identity claim must carry a userHash that only your backend can compute from a secret Nerja gave you.

Compute the hash#

import { createHmac } from "node:crypto";
const userHash = createHmac("sha256", process.env.NERJA_DEVICE_SECRET)
  .update(userId)
  .digest("hex");
// return it to the app after login; the app passes it to Nerja.identify(...)

What changes when it is on#

• Device registration, identify and events with a user_id need a valid hash; unsigned claims lose their user id.
• Anonymous-only device registration is refused.
• Email/phone traits are only honoured when they equal the signed id.
• Devices registered before you turned it on are revoked and must register again.