---
title: "Agent Security"
description: "Protect your agent from abuse with a rate limit, and verify signed-in users with user identification."
---

In your agent, go to **Settings** and scroll to the **Security** section.

## Rate limit

The rate limit caps how many messages one device can send in a period of time on the web widget and Public Chat. It protects your agent, and your credits, from spam and automated abuse.

- **Limit to**: the number of messages allowed.
- **Every (seconds)**: the length of the period.
- **Message to show when limit is hit**: what the visitor sees when they reach the limit, for example "Too many messages in a row".

Select **Reset** to go back to the defaults: 20 messages every 240 seconds.

:::tip
Real customers rarely send more than a few messages a minute. If you see bursts of spam in your **Logs**, lower the limit.
:::

## User identification

User identification lets your website tell Chatvox who a signed-in user is, using a token signed with a secret. Conversations are then linked to the right [contact](/docs/leads-and-contacts/managing-contacts).

From this section you can:

- **Generate secret**: create the agent's secret.
- **Copy**: copy it to store on your server.
- **Rotate**: replace it. Tokens signed with the old secret stop working immediately.
- **Integration guide**: see a quick setup example.

Only team members who can edit the agent can see and manage the secret.

For the full setup, see [User identification](/docs/deployments/web-widget/user-identification).

## Other ways to protect your agent

- **Allowed embed domains**: only let your own websites show the widget. See [Web Widget Behavior](/docs/deployments/web-widget/behavior#allowed-embed-domains).
- **Credits limit**: cap how many credits one agent can use. See [Agent Settings](/docs/agents/settings#credits-limit).
- **Team roles**: control who can change your agents. See [Roles and Permissions](/docs/account-and-teams/roles-and-permissions).