Auth - Attribute

Identify users by passing identity attributes as URL query parameters on the iframe source. No backend required.

How it works

Append user identity fields as query parameters to the iframe src URL. The widget reads these parameters and uses them to identify the user with Returning.AI.

<iframe
  src="https://prod-widgets.returning.ai/store/YOUR_WIDGET_ID?email=user@example.com"
  allow="clipboard-write"
  frameborder="0"
  style="width: 100%; height: 600px; border: none;"
></iframe>

Common attributes

Parameter	Description
email	User email address. The most common identifier.
userId	Your internal user ID.
firstname	User first name.
lastname	User last name.

Security through stacking

The same principle as the SDK: the more attributes you include, the harder it is for someone to spoof the identity. Stack email + userId + custom fields for stronger identification.

<iframe
  src="https://prod-widgets.returning.ai/store/YOUR_WIDGET_ID?email=user@example.com&userId=USR-9a3f2b&firstname=Jane"
  allow="clipboard-write"
  frameborder="0"
  style="width: 100%; height: 600px; border: none;"
></iframe>

Dynamic URL building

If your user data is available in JavaScript, build the URL dynamically:

// Build the iframe URL with user attributes
const baseUrl = 'https://prod-widgets.returning.ai/store/YOUR_WIDGET_ID';
const params = new URLSearchParams({
  email: user.email,
  userId: user.id,
  firstname: user.firstName,
});

const iframe = document.getElementById('widget-iframe');
iframe.src = `${baseUrl}?${params.toString()}`;

When to use

CMS platforms where you can template user data into the iframe URL.
Static sites with known users.
Quick prototyping before implementing token auth.

Custom attributes

Any field that exists on both the client side and the Returning.AI platform can be passed as a query parameter. Custom fields can be created in the admin panel to add layers of identity verification.

Need server-verified identity? See Auth - Token for the backend token flow with postMessage.