Settings, Security & Permissions

Our subdomain managed by intercom was flagged as ‘Unsafe Implementation Of Subresource Integrity’ issue."Unsafe Implementation of Subresource Integrity" usually comes from a scanner flagging that you're loading external scripts or stylesheets (typically from a CDN or third-party service) either without an integrity attribute, with a weak hash, or with integrity present but missing crossorigin. Subresource Integrity (SRI) lets the browser verify that a fetched file hasn't been tampered with by comparing it against a cryptographic hash you specify.Can you do something to mitigate this? Like<script  src="https://cdn.example.com/library@1.2.3/file.min.js"  integrity="sha384-<hash>"  crossorigin="anonymous"></script> 

Hello,We're seeing localized email headers displayed to customers in email conversations.For example, the quoted conversation history contains russian language:От: Отправлено: Кому: Тема:and timestamps such as:(UTC+07:00) TomskOur workspace language is set to English, and we'd like all customer-facing communication to appear in English.Could you please clarify:Where these localized headers are coming from? Whether there is a way to force them to appear in English? Whether there is a setting to prevent timezone names such as "Tomsk" from being shown?I've attached screenshots for reference.Thank you. 

Our need is to have agents always taking chats/calls at all times, without ability for them to switch away from one or the other.  A setting that prevents agents from modifying this is desirable.

DISREGARD - MEANT TO SUBMIT THIS AS A FEATURE REQUEST.

Has anyone successfully managed to setup access for customers to the ticket portal without using JWT authentication? We’re not a SaaS business, and our customers run the software on premises, often behind firewalls without access to the internet, so integrating intercom into the platform is a non starter. I’m looking at launching with Email & Slack channels, but have hit a blocker with the ticket portal feature - ideally I do not want to have to build a customer interface to surface this to customers. 

Hello,Based on the documentation (https://www.intercom.com/help/en/articles/3894-using-intercom-with-content-security-policy), it appears that both unsafe-inline and unsafe-eval need to be added to our Content Security Policy in order for the JavaScript widget to function.From a security perspective, this raises serious concerns, as it increases the attack surface. Our reporting endpoint shows that unsafe-inline isn’t actually required by your code, but unsafe-eval is being triggered in the vendors-app-modern.js file at the following line:var mod = eval("quire".replace(/^/, "re"))(moduleName);Is there any way to eliminate this eval call? If not, we may need to reconsider our use of Intercom due to these security implications.Best regards,Salim

I connected a new feature that became available for the account. However, I cannot disable it; there was no warning about a large payment amount, and I thought there were limits on the number of chats for analytics, but it turns out there is no limit and funds are just being charged continuously. I have already created 4 requests in the chat, but in 4 days, none have received a response or connected me with a specialist.

Hi everyone,I'm trying to implement authentication for the Help Center and ticket portal using JWT, but I'm having trouble finding documentation about what happens after generating the JWT.I already have the JWT generated on my backend, but I can't find clear docs explaining: How to use that JWT to actually log the user into the Help Center How to authenticate them for the ticket/request portal Whether there's a specific endpoint, redirect flow, or client-side method required after obtaining the JWT I also tried following the approach discussed in this community thread, but I couldn't get it to work in my implementation:https://community.intercom.com/settings-security-permissions-22/dynamic-help-center-login-link-11313?tid=11313&fid=22 Most documentation I found explains how to generate the JWT, but not how to complete the login flow with it.Does anyone have: Documentation Example implementations Articles or guides I tried thison how to finish the login process once the JWT

Hello Team, Can you take a look “Why changes in workflow and other settings (banners) won't show on Change Log Section?”Snippets = is okGuidance = is okuser settings = is okWorkflow = NoOutbound banners = NoReally important for us. Easier to check and do audits this that way. 

I’ve tried everything in the doc and through other posts, but  just can’t seem to make this work. The message just doesn’t display at the bottom of the page.

There is a property that the SDK adds to requests to Intercom. It is called anonymous_session . It appears to keep the API calls to Intercom working beyond the JWT expiry. :Why does this keep authentication alive? Is there a way we can disable it to have more control over the amount of time the API is accessible.

We have users worldwide and I have agents in India, UK and Canada.What are the best practices for working with voice channels from countries where we have no office?Example: We have no office in Mexico, it’s impossible to get a local number and have them call into the US or Canada line

Hello,I work on a platform and they are using intercom for their live support chat. I am using for several months and it worked perfectly. But now for over a week, it keeps loading here:  I’ve talked with them via email and even they’re shocked. They don’t know what’s wrong, neither do I. I’ve cleared cache, relogged in, and changed browser, nothing worked. Can anybody please help me out in this regard? Thanks in advance!

I am facing problems while trying to create an account on intercom, the error 403 forbidden appears, it shows that my workspace is suspended, but I have respected all the policies.

Hi!We are not using Fin anywhere in our product and are not currently interested in implementing it. It’s never been integrated into a workflow and I have never manually turned it on. From our customer’s help chat perspective, they are seeing the following header on the chatbox: It happens when the agent they are speaking to goes idle or if the user clicks on a conversation that was previously closed. Why does this show up? I need to remove this. Our product’s customers have no idea what “Fin” is. I also don’t know what “The team can also help” means.Any help would be so appreciated! Thanks

Hi, We are looking to make our Help Center articles mostly limited to just users. We have SSO setup with Entra/Azure and that works fine for access to the backend. Is there a way to leverage Microsoft for access to the Help Center articles so only users that are part of that group can access the articles as well?Thank you!  

I’m having an issue with the workflow in our ticket queue when closing a ticket. Normally when a ticket is closed the next ticket in the queue is automatically selected. For the last couple of days this has not been happening. For the most part it is reverting to the most recent ticket received in the queue, but sometimes it jumps to a random ticket somewehere else in the queue. I seem to be the only member of our team experiencing this so I think I have inadvertantly changed a setting somewhere but cannot find anything about this in the Settings or the Help section.

Hi Intercom Community,We are a returning customer (we was using Intercom for many years until end of 2024 with US data hosting) and want to come back but with EU hosting to make it complaint. I’m hoping to get some help moving the process forward as we seem to be stuck.Our goal is simple: we want to pay for and activate the Intercom Advanced plan with EU data residency. Another words: 😅 To make it as easy as possible, here are all the details: Plan: We need 3 seats on the Advanced plan. Hosting: Data residency in the European Union is a mandatory requirement for us. Commitment: We are ready to pay immediately. We understand an annual commitment is required, and that's perfectly fine. We can even pay for 2 years upfront if it helps accelerate the activation. Context: We were long-time Intercom users who churned in late 2024. We've decided to come back and are fully aware of the product and its capabilities (including the limitations of the EU hosting add-ons). Urgency: We are f

Looking at the implementation of intercom for IOS, the creator seems to leave the API key in the front end. Does this mean that this API key is fine if exposed to the end user? I don’t seem to see another way to obscure it, as keeping the key on the backend doesn’t seem like an option if I want to use intercom’s package.import Intercomlet INTERCOM_APP_ID = "<#YOUR APP ID#>"let INTERCOM_API_KEY = "<#YOUR API KEY#>"class SceneDelegate: UIResponder, UIWindowSceneDelegate { 

I already added all the CNAME and TXT record to my DNS server. However, the outbound.intercom is the only one did not get authenticated and i have already wait more than 48 hours for it.It is because i am in the dev environment? 

Unable to complete payment for enable ( add team member ) module on my workspace, getting something when wrong. i have attached the activity status change with time log and right now getting alert watning screens shot as well for better understanding. looking forward to kind support, as blocked for now to perform / test features testing into our system. Thanks in advance for your kind support.   

After communication with our provider, this was their answer: I see that the DNS-records help.emvo-medicines.eu aren't referring to the servers of Combell, but are referring to the servers of Amazon.You should download the certificate and install it on the servers of the web hosting of help.emvo-medicines.eu. So what steps must i do in order to have the help.emvo-medicines.eu HTTPS certified?

Hi , I am a junior Developer and I have sat up Intercom in my website which has multiple users with different groups or companies so to say, Right now the Integration inside my website is working as it should be, the users i got them from my backend and pass the infor useing tkoen to my Frontend and the audiences is working fine, so i get to know the user and everything from my own website without asking him to sign in, he already did in my app. right now if he clicked a link for Intercom help center which is open in helpcenter there is no way that he could see the article untill he logs in, "Unable to load this article, you may need to sign in first" with the button url.and the Login link which i should be doing is something like this , https://mycompany.login/{group}/the group part shoud be dynmaic and should be passed from my frontend, how to do it please if you could help.also after I login successfluy using my link I want to redirect to the same Intercomaticle  i suppose i could d

Hi,We’re currently reviewing our platforms to ensure they meet the requirements of the European Accessibility Act (Directive (EU) 2019/882).For support services such as Intercom, the EAA requires that: Help desks, call centres, technical support, relay services, and training services provide information on the accessibility of the service. Services must be compatible with assistive technologies (e.g., screen readers, braille displays, voice input). Support and communication must be offered in accessible modes (not only voice but also text, relay, or other inclusive formats). Documentation and guidance should be provided in a clear, understandable, and perceivable format. This is meant to ensure that customers with disabilities can get support in a way they can actually use. For example: A deaf customer might need a text-based chat or relay service. A blind customer might need documentation in a format that works with screen readers. Training on how to use the service with ass

Hello! We frequently use conversations assigned as a daily/monthly metric for reporting purposes. When we remove a teammate and reassign conversations to another Teammate (usually myself), all those conversations appear in the daily reporting. To resolve this, I have to filter myself out of the reporting. This has a significant impact on a lot of our reports that are filtered by teammate and conversations assigned. Is there a way to remove a teammate from Intercom without having conversations reassigned appearing in the reporting?