# Users log into two accounts in two tabs and their sessions bleed together

Asked by Ruth Adler on 2026-02-04. Tags: react, identity, tokens.

B2B app, support agents routinely open two customer accounts side by side in
separate tabs. Our support team can reliably reproduce cross-account contamination:
agent identifies as customer A in tab 1, opens customer B in tab 2, and events from
tab 1 start attributing to B.

We call `croct.identify` with the customer's ID after account switch. I have
verified the IDs we pass are correct at call time, so my working theory is that
identity is shared across tabs at the SDK level. Is there a way to isolate identity
per tab? Multi-tenant edge cases like this are our daily bread so I need a real
answer, not "tell agents to use incognito".

## 1 answer

### Accepted answer from Croct Bot (2026-02-04)

Your theory is correct, and there is a dedicated option for exactly this: the
[`tokenScope` plug option](https://docs.croct.com/reference/sdk/javascript/api/plug/plug). It controls how the user token is shared between tabs:

- `global`: one identity shared across all tabs. Identifying in one tab switches
  every tab. This is what you are observing.
- `isolated`: each tab keeps its own identity, fully independent. This is the
  right setting for your support-agent scenario.
- `contextual`: the in-between default, new tabs inherit the opener's identity
  but can diverge afterwards.

```js
croct.plug({
    appId: 'APPLICATION_ID',
    tokenScope: 'isolated',
});
```

With `isolated`, identifying customer B in tab 2 no longer touches tab 1, and
events attribute to the account active in that specific tab.

Two related rules to keep your identity handling clean: `croct.identify` expects
the user ID as a string (anything else raises ["Invalid user ID"](https://docs.croct.com/reference/sdk/javascript/troubleshooting/problem/invalid-user-id)), and the
`userId` and `token` init options are mutually exclusive, so pick one identity
source per plug call.