{
    "iss": "7cab072d-43d0-4e9d-bb25-2a947696fe8f",
    "iat": 1539766700,
    "exp": 1571386631,
    "aud": "db79e775-84f2e-8741-9266e920cc32",
    "sub": "",
    "field1" : "John"
}

// Install a JWT library
// npm install jsonwebtoken

const jwt = require('jsonwebtoken');

function generateIdentityToken(uniqueIdentifier, apiKey, apiSecret) {
  const payload = {
    aud: uniqueIdentifier, // User's UUID
    exp: Math.floor(Date.now() / 1000) + (60 * 60), // Expires in 1 hour
  };
  
  // Sign with the API SECRET (not the API key)
  const token = jwt.sign(payload, apiSecret, {
    algorithm: 'HS256',
    issuer: apiKey
  });
  
  return token;
}

// Usage
const userUuid = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';
const departmentApiKey = 'your-department-api-key';
const departmentApiSecret = 'your-department-api-secret';
const identityToken = generateIdentityToken(userUuid, departmentApiKey, departmentApiSecret);

 <!-- Start of Glassix Chat Widget -->
<script>
var widgetOptions = {
     apiKey: "7cab072d-43d0-4e9d-bb25-2a947696fe8f",
     snippetId: "dr548fbb5d61ec51869a",
     uniqueIdentifier: "db79e775-81fd-4f2e-8741-9266e920cc32",
     identityToken: "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJ..."
};

(function(n){var u=function(){GlassixWidgetClient&&typeof GlassixWidgetClient=="function"?(window.widgetClient=new GlassixWidgetClient(n),widgetClient.attach(),window.glassixWidgetScriptLoaded&&window.glassixWidgetScriptLoaded()):f()},f=function(){r.src="https://cdn.glassix.net/clients/widget.1.2.min.js";r.onload=u;document.body.removeChild(t);i.parentNode.insertBefore(r,i)},i=document.getElementsByTagName("script")[0],t=document.createElement("script"),r;(t.async=!0,t.type="text/javascript",t.crossorigin="anonymous",t.id="glassix-widget-script",r=t.cloneNode(),t.onload=u,t.src="https://cdn.glassix.com/clients/widget.1.2.min.js",!document.getElementById(t.id)&&document.body)&&(i.parentNode.insertBefore(t,i),t.onerror=f)})(widgetOptions)
</script>
<!-- End of Glassix Chat Widget -->

// server.js
// npm install express jsonwebtoken

const express = require('express');
const jwt = require('jsonwebtoken');
const app = express();

app.use(express.json());

// ---------------------------------------------------------------------------
// Dummy user database
// In production, replace this with a real database query.
// Each user has a stable UUID that must never change across sessions.
// ---------------------------------------------------------------------------
const userDatabase = {
  '[email protected]': {
    uuid: 'db79e775-81fd-4f2e-8741-9266e920cc32',
    firstName: 'John',
    lastName: 'Wick',
    plan: 'premium',
  },
  '[email protected]': {
    uuid: 'a3f1c820-94b2-4d67-b3e5-7f8a2d1c0e9b',
    firstName: 'Jane',
    lastName: 'Doe',
    plan: 'standard',
  },
};

// ---------------------------------------------------------------------------
// Your Glassix credentials (store securely — never expose these client-side)
// ---------------------------------------------------------------------------
const GLASSIX_API_KEY    = '7cab072d-43d0-4e9d-bb25-2a947696fe8f'; // Used as JWT issuer claim
const GLASSIX_API_SECRET = 'your-department-api-secret';            // Used to SIGN the JWT

// ---------------------------------------------------------------------------
// Helper: look up a user in the database
// ---------------------------------------------------------------------------
function getUserFromDatabase(email) {
  // Simulate a database query
  const user = userDatabase[email];
  if (!user) return null;
  return user;
}

// ---------------------------------------------------------------------------
// Helper: generate a signed identity token for a given user UUID
// ---------------------------------------------------------------------------
function generateIdentityToken(userUuid, additionalClaims = {}) {
  const payload = {
    aud: userUuid,                                       // Must match uniqueIdentifier in widget
    exp: Math.floor(Date.now() / 1000) + (60 * 60 * 5), // Expires in 5 hours
    ...additionalClaims,
  };

  // Sign with the API SECRET (not the API key)
  const token = jwt.sign(payload, GLASSIX_API_SECRET, {
    algorithm: 'HS256',
    issuer: GLASSIX_API_KEY, // API key goes in the 'iss' claim
  });

  return token;
}

// ---------------------------------------------------------------------------
// API endpoint: called by your frontend after the user logs in.
// Returns the uniqueIdentifier + identityToken needed by the widget.
// ---------------------------------------------------------------------------
app.post('/api/glassix-identity', (req, res) => {
  const { email } = req.body;

  if (!email) {
    return res.status(400).json({ error: 'Email is required' });
  }

  // Step 1: Retrieve the user's stable UUID from your database
  const user = getUserFromDatabase(email);

  if (!user) {
    return res.status(404).json({ error: 'User not found' });
  }

  // Step 2: Generate a JWT signed with the API secret.
  // Pass optional field claims to pre-populate ticket fields.
  const identityToken = generateIdentityToken(user.uuid, {
    field1: user.firstName,
    field2: user.lastName,
    field3: user.plan,
  });

  // Step 3: Return both values to the frontend
  res.json({
    uniqueIdentifier: user.uuid,
    identityToken: identityToken,
  });
});

app.listen(3000, () => console.log('Server running on port 3000'));

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8" />
  <title>My App</title>
</head>
<body>

  <!-- Simulate a logged-in user session. In production this would come
       from your auth system (e.g. a session cookie or auth token). -->
  <script>
    const loggedInUserEmail = '[email protected]';
  </script>

  <!-- Start of Glassix Chat Widget -->
  <script>
    async function initGlassixWidget() {
      let uniqueIdentifier, identityToken;

      try {
        // Step 1: Fetch the uniqueIdentifier + identityToken from your backend.
        //         This call happens AFTER the user has authenticated.
        const response = await fetch('/api/glassix-identity', {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({ email: loggedInUserEmail }),
        });

        if (!response.ok) {
          throw new Error('Failed to fetch Glassix identity token');
        }

        const data = await response.json();
        uniqueIdentifier = data.uniqueIdentifier;
        identityToken    = data.identityToken;

      } catch (err) {
        console.error('Glassix identity error:', err);
        // Widget will fall back to cookie-based identification
        // if identity verification is not enforced workspace-wide.
        return;
      }

      // Step 2: Pass the credentials to the widget and attach it.
      var widgetOptions = {
        apiKey:           '7cab072d-43d0-4e9d-bb25-2a947696fe8f',
        snippetId:        'dr548fbb5d61ec51869a',
        uniqueIdentifier: uniqueIdentifier,  // User's stable UUID from your DB
        identityToken:    identityToken,     // JWT signed with your API secret
      };

      (function(n){var u=function(){GlassixWidgetClient&&typeof GlassixWidgetClient=="function"?(window.widgetClient=new GlassixWidgetClient(n),widgetClient.attach(),window.glassixWidgetScriptLoaded&&window.glassixWidgetScriptLoaded()):f()},f=function(){r.src="https://cdn.glassix.net/clients/widget.1.2.min.js";r.onload=u;document.body.removeChild(t);i.parentNode.insertBefore(r,i)},i=document.getElementsByTagName("script")[0],t=document.createElement("script"),r;(t.async=!0,t.type="text/javascript",t.crossorigin="anonymous",t.id="glassix-widget-script",r=t.cloneNode(),t.onload=u,t.src="https://cdn.glassix.com/clients/widget.1.2.min.js",!document.getElementById(t.id)&&document.body)&&(i.parentNode.insertBefore(t,i),t.onerror=f)})(widgetOptions)
    }

    document.addEventListener('DOMContentLoaded', initGlassixWidget);
  </script>
  <!-- End of Glassix Chat Widget -->

</body>
</html>