[Holmus]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature. (Not required: internal support widget.)
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

HubSpot chat in the dashboard shows every logged-in user as "Unknown Visitor". The widget doesn't know who is chatting, so tickets created from chat have no contact or company. HubSpot's Visitor Identification API fixes this. The token has to be created server-side with our HubSpot access token, so this adds an endpoint the dashboard can call. This replaces what pylon_email_signature did for Pylon chat.

• GET /api/v1/auth/users/me/hubspot-chat-token/ returns {"token": "..."} for the requesting user (email, first name, last name). HubSpot tokens are valid for 12 hours.
• Returns 404 when HUBSPOT_ACCESS_TOKEN isn't set (self-hosted), and 502 when HubSpot fails. The dashboard loads the chat anonymously in both cases.
• Throttled to 10 requests per minute per user (hubspot_chat_token scope), because it shares the HubSpot token's rate limit with lead tracking.
• The HubSpot call has a 5 second timeout. Errors are logged, not raised.

Before this works in production: the HubSpot private app behind HUBSPOT_ACCESS_TOKEN needs the conversations.visitor_identification.tokens.create scope. HubSpot also only allows this API on a Professional or Enterprise subscription; otherwise every call gets the 502 path.

The dashboard side is #8814. It falls back to anonymous chat while this endpoint isn't deployed.

Review effort: 2/5

How did you test this code?

• Unit tests for the client (token returned, empty names sent as null, HubSpot error and timeout) and the view (200, 404, 502, 401, 429).
• Locally: the custom_auth, lead_tracking, onboarding and users test suites pass. ruff and mypy are clean on the changed files, and the OpenAPI schema generates with the new endpoint.
• Manual check on staging once the private app has the new scope: call the endpoint as a logged-in user and get a token back.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated
docs	Ignored	Preview	Oct 20, 2026 4:14pm UTC
flagsmith-frontend-preview	Ignored	Preview	Oct 20, 2026 4:14pm UTC
flagsmith-frontend-staging	Ignored	Preview	Oct 20, 2026 4:14pm UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.88%. Comparing base (c582d5b) to head (e8b55c5).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8813   +/-   ##
=======================================
  Coverage   98.88%   98.88%           
=======================================
  Files        1683     1683           
  Lines       70275    70363   +88     
=======================================
+ Hits        69489    69577   +88     
  Misses        786      786           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[talissoncosta]

question: Could the response include the email the token was minted for, { "token": ..., "email": ... }? HubSpot needs identificationEmail to match the token's email, and it lets the UI avoid reading the user from AccountStore (context in #8814).