Fin Messenger: Set up JWT authentication for Salesforce Enhanced Chat

This article explains how to generate and configure the JSON Web Token (JWT) required for Fin Messenger to authenticate users when routing conversations to Salesforce Enhanced Chat. Completing these steps lets Fin securely pass user identity to both Fin and Salesforce, so your teammates can trust the identity of customers they're speaking with.

Note: Prerequisites: Fin Messenger must already be installed in your app, and a Salesforce Enhanced Chat Messaging Channel must be configured. The Ruby jwt gem is required if using the Rails code examples below. This feature is available on Fin Messenger plans that include Salesforce integration — contact your account team to confirm access.

You must add the JWT to your intercomSettings attributes to enable Fin Messenger authentication with Salesforce Enhanced Chat:

intercom_user_jwt
- This is used to securely provide Fin with the Contact ID and any attributes for the Contact or Account that you want to provide to Fin (or Salesforce)

Omitting intercom_user_jwt means Fin cannot securely pass contact data to Salesforce.

The JWT must be generated server-side on each page load for the current user, using a private key. Follow these steps to obtain each key and enable user verification in Fin Messenger and Salesforce:

Retrieve your Intercom private key — go to Settings > Messenger > Security and copy your Messenger API Secret. This is the signing key for intercom_user_jwt.
See Fin Messenger: Enabling user verification in Salesforce for step-by-step instructions for enabling User Verification in Salesforce. Fin will handle generating the Salesforce JWT once configured.

The following Rails example shows how to generate the JWT for Fin Messenger and Salesforce Enhanced Chat authentication and pass them into your intercomSettings object:

Rails view — passing JWTs into intercomSettings for Fin Messenger:

  window.intercomSettings = {
    api_base: "https://api-iam.intercom.io",
    app_id: "your-app-id-here",
    user_id: "<%= current_user&.id %>",
    intercom_user_jwt: "<%= intercom_jwt(current_user&.id %>",
  };

Rails helper — generating the Fin JWT for Fin Messenger:

intercom_jwt uses HS256 (HMAC-SHA256, a symmetric signing algorithm) with your Intercom Messenger API Secret.

  def intercom_jwt(user_id)
    JWT.encode({ user_id: user_id, exp: Time.now.to_i+3600 }, INTERCOM_JWT_SECRET, "HS256")
  end

Note: The JWT is set to expire after 1 hour (exp: Time.now.to_i + 3600). It must be regenerated on each page load — do not cache it between sessions. If a JWT expires mid-conversation, the customer may need to refresh the page to re-authenticate.

💡Tip

Need more help? Get support from our Community Forum
Find answers and get help from Intercom Support and Community Experts

Related Articles