User identity

Self-declared

TraceItX.shared.setUser(TXUser(id: "u_1042", email: "jane@example.com", displayName: "Jane"))
TraceItX.shared.setUser(nil)  // on sign-out

This is an unauthenticated claim. It is genuinely useful — most reports come from your own QA and beta users — but it is not evidence.

Call it after start(). start() begins a session with no user, and setUser is a no-op while the SDK is not started, so a value set before it is silently lost. Read it back with TraceItX.shared.currentUser.

Verified

To make it evidence, supply a token your backend signed:

// A token you already hold:
TraceItX.shared.setIdentityToken(.token(jwt))

// Or a provider, asked for a fresh one whenever it is needed:
TraceItX.shared.setIdentityToken(.provider { await fetchTokenFromMyBackend() })

Prefer .provider. It is asked for a fresh token when one is needed rather than holding a long-lived value — which matters on mobile, where an app can sit backgrounded for weeks between a sign-in and a bug report.

Pass nil to clear it.

The server verifies the token and resolves the person itself, rather than trusting anything the client asserted. Tokens are only presented once the server’s identity block confirms the project has a signing secret; until then the provider is never called.

The three tiers

A webhook receiver sees data.reporter, resolved server-side:

Use data.reporter, not data.report.reporter.user. The latter is whatever the app passed to setUser — an unauthenticated claim in every case, even when a valid token was also presented.

anonymous does not mean “unverified” — it means nobody was resolved. Treat the three as distinct states, not a confidence gradient. See Webhooks.

Sign-out

Calling setUser(nil) clears the self-declared user from future reports. Calling setIdentityToken(nil) drops the cached token immediately and discards the evidence already buffered — breadcrumbs, console, network — so a shared device does not carry one person’s activity into another person’s report. On sign-out, call both.

What actually reaches the report

TXUser is projected down to id, email and displayName. Nothing else travels, so a richer user object on your side does not quietly ship internal fields.