Verify which account a report came from

Reports are anonymous by default. If you want to know which of your users an agent was working for, or which person sent a report from your web app, attach a verified account. Agentback accepts an account only when it can tell your product vouched for it, so a public project key cannot be used to report as someone else.

Use an opaque account ID, such as a user or tenant ID. Never send an email address.

With the secret key

Clients that hold the secret key, such as a hosted MCP server or your backend, pass the account directly:

ts
attachToMcp(server, agentback, {
  product: 'Your product',
  identify: () => ({ account: session.accountId }),
});

With the project key

A local MCP server, a CLI and a web app use the public project key, which cannot vouch for an account. Your backend signs the account ID with the project's identity secret, and the client passes the signature along. A good place to hand it over is the response your CLI, MCP server or web app already gets when the user signs in.

ts
// On your backend
import { signAccount } from 'agentback';
const signature = await signAccount(
  process.env.AGENTBACK_IDENTITY_SECRET,
  accountId,
);

ts
// In a local MCP server
attachToMcp(server, agentback, {
  product: 'Your product',
  identify: () => ({ account: accountId, signature }),
});
// In a CLI
runFeedbackCommand(agentback, args, {
  program: 'mycli',
  identify: () => ({ account: config.accountId, signature: config.signature }),
});
// In a web app, once the person has signed in
window.Agentback?.identify({ account: accountId, signature });

The signature is a hex HMAC-SHA256 of the trimmed account ID, keyed with the identity secret, so a backend in any language can compute it without the package.

What happens to a wrong signature

A report with an account and a missing or wrong signature is rejected with 401, so unverified accounts never reach your inbox. Rotating the project's keys replaces the identity secret and invalidates every existing signature.

If your product has no backend, skip this: reports stay anonymous.

Hand the setup to your coding agent

Paste one prompt into Claude Code, Cursor or Codex. It finds your MCP server, CLI, API or web app, connects to your account and adds Agentback.

Create a free inbox

Web widget Triage with your coding agent