# Sign users in to the messenger

Tell the messenger who your signed-in users are, and keep their conversations safe.

When people are signed in to your product, let the messenger know who they are. Their conversations follow them across devices, and your team can see exactly who they're talking to.

### Pass their details

Go to **Settings → Apps**, open your web app and choose **Secure users** in the install section. You'll get a snippet like this, with your user's details filled in by your own code:

```
window.karadeskSettings = {
  space_id: "YOUR_SPACE_ID",
  app_id: "YOUR_APP_ID",
  user_id: currentUser.id,
  email: currentUser.email,
  name: currentUser.name,
  user_hash: currentUser.karadeskHash,
}
```

You need a `user_id` or an `email`. Everything else is optional, and you can also pass `phone`, `avatar` and `signed_up_at`.

### Turn on identity verification

Without verification, someone could pretend to be one of your users by changing the user ID in their browser. Identity verification stops that.

On your server, sign each user's ID with your app's **Identity verification secret** from **Settings → Apps**, and pass the result as `user_hash`:

```
import crypto from "node:crypto"

const karadeskHash = crypto
  .createHmac("sha256", process.env.KARADESK_IDENTITY_SECRET)
  .update(String(user.id))
  .digest("hex")
```

Keep the secret on your server. Never put it in your website or app.

Once your server sends a hash for every signed-in user, turn on **Require identity verification** for the app. From then on, KaraDesk only accepts signed-in users with a valid hash. Visitors who aren't signed in can still chat as usual.

If you ever need a new secret, click **Rotate secret**. The old one stops working right away, so update your server first.

### When someone signs out

Call `KaraDesk("shutdown")` when a user signs out. It clears their session from the browser, so the next person on that device starts fresh.

### In your iOS app

The iOS SDK works the same way. Pass the hash from your server as `userHash` when you call `KaraDesk.login`, and call `KaraDesk.logout()` when someone signs out. See [Install KaraDesk in your iOS app](/articles/6) for the details.