This guide helps your team get more value from TurboHelp's Live Chat tools. Use it to understand the feature, configure it correctly, and know what to check before relying on it in your daily support workflow.
At a Glance
Use the live chat widget to support visitors in real time without forcing them to leave your site.
Configure identity, routing, forms, and campaigns before driving production traffic to the widget.
Test the widget on desktop and mobile after every meaningful configuration change.
If you are authenticating users via email from outside TurboHelp, it's highly recommended to generate and email hash on the server using a secure key, to prevent bad actors from spoofing the identity of another user, by providing an email different than their own. This could allow an attacker to pose as a real user to your teammates, giving access to previous conversations and potentially sensitive data.
Generate an email hash on your server
To secure the widget you'll need to generate an HMAC on your server for each logged-in user using their email address and a secret widget key and send it to TurboHelp. Refer to the language or framework you are using on how to generate an HMAC, this is an example for PHP:
$widgetSecretKey = 'xxxxNE5wdzVEQm9CeUVMTJxxx'; // IMPORTANT: replace with your own secret
$email = '[email protected]';
$emailHash = hash_hmac('sha256', $email, $widgetSecret);Tip: You can get the secret widget key from Admin > Settings > Live Chat > security panel.
Sending Email Hash to TurboHelp
After generating an email hash, you can send it along with other user information on every page where Live Chat widget is loaded.
Example
window.BeChatSettings = {
user: {
name: 'John Appleseed',
email: '[email protected]',
email_hash: 'INSERT_HMAC_VALUE_HERE' // IMPORTANT: replace with email hash generated from above example
subscriptionPlan: 'Premium',
company: 'Pixel Perfect Designs'
}
}
<script src="https://your-turbohelp-domain.com/livechat-loader.js"></script>Enforce Identity Verification on Live Chat Widget
After you have configured your site to send email hash, you should enable identity verification from Admin > Settings > Live Chat > security page. This will cause any attempts to authenticate a user to fail, if email hash does not match.
Best Practices
Keep the first widget experience short: ask only for the information agents truly need.
Verify identity for logged-in users before exposing account-specific conversation history.
Check widget behavior on key pages after changing themes, forms, or security rules.