Custom customer authentication

Custom customer authentication lets you authenticate customers with your own system instead of using Shopify accounts or Cevoid email authentication. This is useful for headless setups or stores running on platforms other than Shopify: for the rest of their setup, see General implementation. In the app, the method is called Custom store authentication.

The implementation involves signing a payload with a key provided by Cevoid and attaching the signature to your widget embed code.

1. You retrieve customer information from your authenticated session
2. You create a digest on the server: an HMAC-SHA256 signature of the customer's ID and email
3. You pass the digest, the customer info, and your tracking ID to the Cevoid widget div code
4. Cevoid finds your workspace by the tracking ID, verifies the digest, and authenticates the customer

Set Authentication to Custom store authentication in Settings → Loyalty → General⁠. For the steps, see Change the authentication method.

The next steps need your workspace's encryption key and tracking ID. Copy both from Settings → Loyalty → General⁠.

Copy the widget's code from the embed dialog, under Embed with code: see Embed with code. The page also needs the Cevoid script for program widgets: see Add the Cevoid script for program widgets.

The copied embed code looks like this. For a single section, it also has data-section:

<div class="cevoid-widget" data-id="ew-3qGflV" data-type="engage"></div>

Add your tracking ID as data-tracking-id:

<div 
  class="cevoid-widget" 
  data-id="ew-3qGflV" 
  data-type="engage"
  data-tracking-id="CV-1234-1"
></div>

Add the following data attributes with your authenticated customer's information:

<div
  class="cevoid-widget"
  data-id="ew-3qGflV"
  data-type="engage"
  data-tracking-id="CV-1234-1"
  data-user-email="{{ EMAIL }}"
  data-user-id="{{ EXTERNAL_USER_ID }}"
  data-user-name="{{ NAME }}"
></div>

The digest authenticates the customer and must be generated server-side.

Payload format: {{ EXTERNAL_USER_ID }},{{ EMAIL }}, with the same ID you use in data-user-id

For example, for a customer with ID 1234 and email viktor@cevoid.com, the payload is:

1234,viktor@cevoid.com

Signature method: HMAC with SHA256 algorithm, signed with your encryption key, as a hex string.

Node.js example:

const crypto = require('crypto');

const encryptionKey = 'YOUR_ENCRYPTION_KEY';
const userId = '1234';
const email = 'viktor@cevoid.com';

const digest = crypto
  .createHmac('sha256', encryptionKey)
  .update(`${userId},${email}`)
  .digest('hex');

Add the generated digest as data-digest:

<div
  class="cevoid-widget"
  data-id="ew-3qGflV"
  data-type="engage"
  data-tracking-id="CV-1234-1"
  data-digest="{{ DIGEST }}"
  data-user-email="{{ EMAIL }}"
  data-user-id="{{ EXTERNAL_USER_ID }}"
  data-user-name="{{ NAME }}"
></div>

For a customer with:

• ID: 1234
• Email: viktor@cevoid.com
• Name: Viktor

The final embed code looks like this:

<div
  class="cevoid-widget"
  data-id="ew-3qGflV"
  data-type="engage"
  data-tracking-id="CV-1234-1"
  data-digest="a1b2c3d4e5f6..."
  data-user-email="viktor@cevoid.com"
  data-user-id="1234"
  data-user-name="Viktor"
></div>

Custom customer authentication works with the opt-in rules All customers, Widget opt-in, and Invite only. A logged-in customer who isn't a member sees Join now in your program widgets: visiting a widget doesn't enroll them automatically. With Invite only, they can't join from a widget. See How opt-in rules work.