The following settings are required in order to allow the Tickets Portal to work properly and securely:
☑️ Intercom Messenger installed for logged in users
☑️ Help Center must be Live
☑️ Help Center custom domain & Cookie Forwarding set up
☑️ Messenger security setup and enabled
☑️ Prevent updates via the Messenger
Required settings
Intercom Messenger installed for logged in users
To identify your users, Intercom must be installed for logged in users on your site.
Note: The Ticket Portal is not available on the Essentials Plan. You'll need to be on the Advanced or Expert plan to set up and use the Tickets Portal.
Help Center custom domain & Cookie Forwarding
Once a user has logged in on your site, their Intercom Session Cookies are used to authenticate users on the Tickets Portal. This relies on having a Help Center custom domain and Cookie Forwarding set up.
Specifically the two cookies are:
intercom-session-<workspace-id>
intercom-device-id-<workspace-id>
If you're using Cloudflare, Intercom may not be able to detect that cookie forwarding is correctly setup. In this case, the warning banner can be ignored in the Intercom configuration.
You must also ensure that your Help Center custom domain uses SSL and that you’ve selected the HTTPS security protocol in Help Center Settings.
Messenger security enabled with JWTs
To protect the Tickets Portal from user impersonation, Messenger Security with JWTs must be enforced on your workspace.
You can find the setup for this in your Messenger security settings.
Prevent updates via the Messenger
To protect the Tickets Portal from company impersonation, you also need to prevent insecure updates to the Companies attribute via the Messenger. You'll still be able to populate and update this attribute via the Messenger through a valid JWT but insecure updates will fail.
This is only possible if the method for updating associations is using the REST API mentioned in the previous step.
Head to Settings > Data > People and select the edit tool next to Companies (default attribute).
Now toggle the “Require verified updates” setting on the attribute and click Save.
By doing this, a Company can no longer be created or updated via the frontend JavaScript snippet. This means that you will need to use the REST API to create or update Companies in Intercom.
Please note, that only teammates with Can manage and publish Help Center articles permission will be required to set the Tickets Portal live.
Need more help? Get support from our Community Forum
Find answers and get help from Intercom Support and Community Experts