Identity Verification blocks unauthorized individuals from impersonating others and accessing potentially private information (i.e., author-only posts & other details you’ve sent about the user). If you plan on using Featurebase with logged-in users, we highly recommend implementing Identity Verification to ensure the safety of your community.

Do I need Identity Verification?

In short, you should almost always set up identity verification in Featurebase.

If you're only collecting feedback from website visitors who don’t log in, Identity Verification isn't necessary. It only applies to users for whom you have identifiable information, such as an email address or user ID.

What is a user impersonation attack?

Without Identity Verification, there’s a risk that bad actors could impersonate a user. This means someone could access a user’s past feedback, pose as that user to your team, and potentially manipulate actions on their account.

For instance, without Identity Verification, an attacker could interact with your feedback portal or widget and spoof another user’s identity by providing a known identifier, such as their email address or user ID. This would allow them to appear as a legitimate user, exposing previous conversations and potentially sensitive data.

How does Identity Verification protect my organization?

With Identity Verification enabled, a unique user hash is generated for each of your users based on their email address or user ID, combined with your workspace’s identity verification secret (available in Settings → Identity Verification).

This hash is sent with every feedback request, allowing us to verify that the request truly came from your platform.

Identity Verification blocks cross-user impersonation by preventing third parties from sending valid user hashes without access to your secret. Once enforced, Featurebase won’t log in or accept feedback requests from users unless a valid hash is provided.

Does Identity Verification affect the user experience?

With Identity Verification correctly implemented, there is no disruption to your users. They will continue to interact with your feedback portals or widgets as usual without needing to take any extra steps.