Widget Authentication

1. SDK collects session context (sessionId, anonymousId, userId, sdkKey, device)
2. SDK sends context to widget iframe via postMessage
3. Widget iframe POSTs to /public/widget/auth
4. API validates the SDK key, creates/finds the user, returns a widget JWT
5. Widget stores the JWT and sends hacktionbase:widget_auth_success back to SDK

{
  sessionId: string;      // Current session ID
  anonymousId: string;    // Persistent anonymous ID (survives sessions)
  userId?: string;        // Set after identify() is called
  accountId?: string;     // Set if user has an account
  userHash?: string;      // HMAC for identity verification
  sdkKey: string;         // Your SDK key
  timestamp: number;      // Current timestamp
  device: DeviceInfo;     // Browser, OS, screen, language, timezone
}

// Server-side (Node.js)
const crypto = require('crypto');
const userHash = crypto
  .createHmac('sha256', 'YOUR_SDK_SECRET')
  .update(userId)
  .digest('hex');

Hacktionbase.identify({
  id: 'user_123',
  email: 'jane@example.com',
  userHash: 'computed_hmac_hash'
});