User identity

Self-declared

TraceItX.setUser(TXUser(id = "u_1042", email = "jane@example.com", displayName = "Jane"))
TraceItX.setUser(null)  // on sign-out

This is an unauthenticated claim. It is genuinely useful — most reports come from your own QA and beta users — but it is not evidence.

Call it after start() — before that it is a no-op. Read it back with TraceItX.currentUser.

Verified

To make it evidence, supply a token your backend signed:

// A token you already hold:
TraceItX.setIdentityToken(IdentityTokenSource.Token(jwt))

// Or a provider, asked for a fresh one whenever it is needed:
TraceItX.setIdentityToken(IdentityTokenSource.Provider { fetchTokenFromMyBackend() })

Provider takes a suspend function. Prefer it — it is asked for a fresh token when one is needed rather than holding a long-lived value, which matters on mobile, where an app can sit backgrounded for weeks between a sign-in and a bug report.

Pass null to clear it. setIdentityToken works before start() too; the token is held in memory and only used once a report is submitted.

The server verifies the token and resolves the person itself, rather than trusting anything the client asserted. Verified identity is also gated per app by the identity block of server config — with it off, the token is never sent.

The three tiers

A webhook receiver sees data.reporter, resolved server-side:

Use data.reporter, not data.report.reporter.user. The latter is whatever the app passed to setUser — an unauthenticated claim in every case, even when a valid token was also presented.

anonymous does not mean “unverified” — it means nobody was resolved. Treat the three as distinct states, not a confidence gradient. See Webhooks.

Sign-out

Calling setUser(null) clears the self-declared user from future reports. Calling setIdentityToken(null) clears the verified identity and discards buffered evidence — breadcrumbs, logs, network metadata and bodies — rather than re-attributing it. That matters on shared devices — a kiosk, a family tablet — where the alternative is one person’s activity appearing in another person’s report. Replay frames are not discarded on sign-out.

What actually reaches the report

TXUser is projected down to id, email and displayName. Nothing else travels, so a richer user object on your side does not quietly ship internal fields.