Skip to main content
Security

Signatures now tell people and groups apart

Identity verification signatures are over a person: or group: prefix, so a group signature can never pass for a person with the same id.

A signature for a group could be reused for a person whose id was the same, for example user 7 and company 7. Signatures are now made over person:<id> for /identify and /track, and over group:<id> for /group. A signature of the bare id is no longer accepted and gets 401 invalid_signature.

Change your server to sign with the prefix. The secret stays the same. Code examples are in the REST API guide and on how signing works.

All changes