canonical: https://jentic.com/apis/hubspot.com/hubspot-conversations-visitor-identification

# HubSpot Visitor Identification

The HubSpot Visitor Identification API issues short-lived identification tokens that pass authenticated visitor identity into the HubSpot chat widget. It accepts an email and friendly name from your own authentication system, and returns a token that the HubSpot chat widget consumes so the chat session is associated with a known contact rather than an anonymous visitor. This is the primary surface for identified-visitor chat experiences on HubSpot-hosted and embedded chat widgets.

## For AI agents

Generate identification tokens that link an authenticated user to the HubSpot chat widget so chat sessions are tied to a known contact. Useful for agents wiring up SSO chat experiences.

## Scope

Does not authenticate users, send chat messages, or manage CRM contacts - use for issuing HubSpot chat widget identification tokens only.

## Capabilities

- Generate a HubSpot visitor identification token from an email and friendly name
- Return a token suitable for the HubSpot chat widget identifyVisitor call
- Pair authenticated visitors from an external SSO with HubSpot contact records
- Issue short-lived tokens that expire to limit replay risk

## Use cases

### Authenticated Chat for Logged-In Customers

When a customer is signed into your portal, call POST /visitor-identification/v3/tokens/create with their email and name to mint a token. Pass the token to the HubSpot chat widget's identifyVisitor call so the chat session is tied to the matching HubSpot contact, allowing reps to see history without verifying identity again.

Example prompt: On portal login, POST /visitor-identification/v3/tokens/create with the user's email and friendly name, then return the token to the front-end for `hsConversationsSettings.identificationToken`.

### SSO Chat Bridging

Bridge a single sign-on session into HubSpot chat by minting an identification token after the SSO handshake. Useful for B2B portals where every chat user is already authenticated and the support team needs the conversation tied to a known account immediately.

Example prompt: After SSO success, POST /visitor-identification/v3/tokens/create with the authenticated email and name, and return the token to the chat widget.

### High-Trust Support Channels

Reduce verification friction for known account holders by stamping every chat session with an identification token. Reps see the matching CRM record automatically, and chat history persists across sessions without prompting visitors to re-enter contact details.

Example prompt: POST /visitor-identification/v3/tokens/create with the verified user's email and name when they navigate to the support page.

### Agent-Issued Chat Tokens

Use Jentic to issue HubSpot identification tokens from an AI agent without embedding HubSpot SDK code in the application. The agent invokes the token-issue operation by intent, and the HubSpot OAuth or private app token used to call HubSpot stays in your Jentic One instance.

Example prompt: Use Jentic search 'generate a HubSpot visitor identification token', load the POST /visitor-identification/v3/tokens/create schema, and execute with email and friendly name.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /visitor-identification/v3/tokens/create | Generate a visitor identification token |

## Key resources

- **Identification tokens** — Short-lived tokens minted from an email and friendly name and consumed by the HubSpot chat widget.

## Why Jentic

- **Setup:** Wiring HubSpot Visitor Identification by hand means learning its OAuth2 access token or private app token auth, targeting the api.hubapi.com host, and posting the identification token request yourself. Through Jentic you install once, import HubSpot Visitor Identification from the API Directory, store the token once, and your agent calls it.
- **Permission scoping:** The Visitor Identification API takes the visitor's email and details in the request body, so limit the agent to the operations it needs, such as creating a chat identification token. You choose which operations are allowed, and here the single token-create call is the only operation this API exposes.
- **Credential handling:** Your HubSpot access token or private app token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'generate a chat identification token', and Jentic returns the matching POST /visitor-identification/v3/tokens/create operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **HubSpot Conversations Inbox & Messages** — Read and reply within the inbox that an identified chat lands in.
- **HubSpot CRM Contacts** — Look up or create the contact that an identification token is tied to.
- **HubSpot Conversations Custom Channels** — Surface external chat channels alongside identified-visitor chat.

## FAQ

### What authentication does the HubSpot Visitor Identification API use?

OAuth 2.0 authorization code flow or a private app token in the `private-app-legacy` header. Through Jentic, the credential is held encrypted in the vault and the agent only sees a scoped execution token.

### Can I tie a logged-in user to a HubSpot contact via this API?

Yes. POST /visitor-identification/v3/tokens/create accepts an email and friendly name and returns a token. Pass it to the chat widget's `identificationToken` setting so HubSpot links the session to the contact matching that email.

### What are the rate limits for the Visitor Identification API?

Standard HubSpot API limits apply - roughly 100 requests per 10 seconds per OAuth app. Issue tokens on demand at session start rather than for every page navigation to avoid hitting the per-second ceiling.

### How do I issue a token through Jentic?

Search Jentic for `generate a HubSpot visitor identification token`, load the POST /visitor-identification/v3/tokens/create schema, and execute with the user's email and name. Install with `pip install jentic` and authenticate using `JENTIC_AGENT_API_KEY`.

### How long does an identification token stay valid?

HubSpot issues short-lived tokens intended for a single chat session - they typically expire within hours. Mint a fresh token at session start rather than caching one across sessions.

### Can I limit what my agent is allowed to do with the HubSpot Visitor Identification API?

Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials the agent may use. This API exposes a single operation, POST /visitor-identification/v3/tokens/create, so you can allow just that token-create call and nothing else. Your HubSpot OAuth or private app token stays in your own instance and is injected only when the agent runs the operation you permitted.