Authentication

Overview

The Asiyst Web SDK uses a public-key security model combined with browser Origin validation. Public keys are safe to embed in client-side HTML and JavaScript bundles.

Client Authentication Protocol

1. During initialization, the SDK transmits publicKey and projectId to the gateway.

1. The Asiyst Edge Gateway extracts the HTTP Origin and Referer headers.

1. The server validates the origin against your project's Allowed Domains list.

1. If verified, the server returns an ephemeral JWT token valid for 24 hours.

User Identification via identify()

Link visitor conversations with your authenticated user database:

Asiyst.identify({
  userId: "usr_8839102",
  email: "developer@acme.com",
  name: "Jane Doe",
  traits: {
    tier: "Enterprise",
    role: "Admin",
  },
});

Session Revocation on Logout

// Reset session and clear cached tokens on user sign-out
Asiyst.logout();