Connect your customer login

1. Configure the assistant

Choose a Double Engine package, enable the bot in Dashboard → Double Engine, and configure its website domain. Under Website login, save an HTTPS issuer URL and generate a signing key. Store the key only on your backend.

2. Sign an assertion on your server

Use HS256, a unique UUID for every jti, the exact configured issuer and a lifetime no longer than five minutes. Derive the subject, name and verified email from the authenticated server session. Never accept those fields directly from a browser request.

// Node.js backend example, using jsonwebtoken
const now = Math.floor(Date.now() / 1000);
const assertion = jwt.sign({
  sub: authenticatedCustomer.id,
  name: authenticatedCustomer.name,
  email: authenticatedCustomer.verifiedEmail,
  jti: crypto.randomUUID(),
  iat: now,
  exp: now + 120,
  iss: process.env.CRMAIBOT_IDENTITY_ISSUER,
  aud: "double-engine:" + botId
}, process.env.CRMAIBOT_IDENTITY_SECRET, { algorithm: "HS256" });
// Return only the assertion to your authenticated browser/app.
// Set Cache-Control: no-store on this response.

A stable subject is linked to the verified email for this bot. An unexpected email change requires reconnecting the identity through the business; it never silently switches customer records.

3. Identify the customer in the widget

Install the Double Engine widget, then call identify after login. The widget queues the assertion until its secure frame is ready.

<script src="https://crmaibot.com/widget.js"
  data-bot-id="YOUR_BOT_ID" data-product="double-engine" defer></script>

// Call after your authenticated backend returns a fresh assertion.
window.CRMAIBOTDoubleEngine["YOUR_BOT_ID"].identify(assertion);

// Call on your website's logout event.
window.CRMAIBOTDoubleEngine["YOUR_BOT_ID"].logout();

// If the script is still loading, wait for:
window.addEventListener("crmaibot-double-engine-loaded", event => {
  // event.detail.botId identifies the ready widget API.
});

Do not put assertions or customer details in URLs. Each assertion can be exchanged once. On login changes, request a fresh assertion. Keep any returned session token only in memory.

App integration

From your trusted server, exchange the assertion with POST /api/assistant/YOUR_BOT_ID/double-engine using {"action":"identify","assertion":"SIGNED_ASSERTION"} and an Origin matching the CRMAIBOT Host. Forward the resulting opaque token securely to your app, then use it as a Bearer token for subsequent requests through your server. Sessions expire after 30 minutes. The chatbot determines the mode; clients cannot request Support by setting a mode flag.

For chat, submit action “message”, a fresh UUID requestId and message. Reuse the same requestId only when retrying the same message. For logout, submit action “logout” and discard the prior token and all private conversation data.

Customer records and connected systems

Support reads records already associated with the verified customer, business and bot. Configure available providers under Shopping & Services. A login assertion does not grant arbitrary access to an external CRM, helpdesk or store; those systems need an authorized connection and customer mapping.

Return and callback forms create requests for staff review. They do not automatically issue refunds, cancel orders or confirm bookings.