Guides, API references, and playbooks
Integration docs live on this site and the docs subdomain. Start with quick start, then Events GET for every fraud decision.
Library
Featured resources
How to Detect Bots Without CAPTCHA
Detect automation, headless browsers, and scrapers with server-side signals, then challenge only the traffic that actually looks risky.
Blog
Persistent Visitor ID vs. Session ID: The Complete Developer Guide
Session IDs track one visit. Persistent visitor IDs connect visits over time. Learn when to use each and why modern analytics and fraud stacks need both.
Blog
State of Visitor Identification Benchmarks 2026
How DigitalFingerprint validates same-browser visitor identification in production: ≥99% control/test continuity, browser matrix, Device Farm testing, and what required-scenario false-negative gates mean for your stack.
Blog
Why Cookies Are Dead (And What Smart Websites Are Using Instead)
Cookies are becoming unreliable for analytics, attribution, and fraud prevention. Learn how persistent visitor identification helps modern websites recognize returning visitors.
Blog
Getting started with DigitalFingerprint
Install @digitalfingerprintjs/client (npm) or load the official CDN, init with a public pk_… browser key (platform-managed integrity — never put signingSecret in page JS), and wire eventId to your backend Events GET with a secret sk_… key.
Guide
Confidence & rules
Single assignment path with confidence v2 fusion penalties. Gate fraud signup via Events GET and rules presets; SDK 1.0 auto-seeds clientToken.
Guide
Confidence model (v1 & v2)
Merge false-positive risk on a 0–100 scale (v2), linkConfidence, fusion penalties, and signup gate patterns.
Reference
Smart Signals field guide
bot, vpn, proxy, tampering, velocity, ipInfo, ipBlocklist, highActivityDevice, and mobile integrity fields on Events GET.
Reference
POST https://api.digitalfingerprintjs.com/api/identify
Authentication, request signing, slim vs full responses, Limiter enforcement, error codes, and rate limits on the api. host.
Reference
GET/PATCH /api/events/:eventId
Server-authoritative enrichment: confidence, smartSignals, suspectScore, ruleAction; PATCH for linkedId/tags after identify.
Reference
Limiter preset rulesets
Import Analytics & marketing, Signup & fraud protection, and Shared & corporate devices templates from the console Limiter page.
Reference
Cross-domain identification
Deploy a second origin with the same project API key, add each domain to allowed hostnames and verify matching in the live demo.
Tutorial
Go live on production
Public/secret API keys, allowed hostnames, slim responses, webhooks, and the production integration checklist.
Ops
Fingerprint-compatible responses
Side-by-side evaluation with ?format=fingerprint on identify and Events GET. Native confidence is 0–100; export uses 0–1.
Migration
Fraud use-case playbooks
Account takeover prevention, credential stuffing detection, and visitor ban enforcement — identify in the browser, decide after Events GET with example (tunable) rules.
Playbook
Production trust model
Slim browser payloads, 5-minute eventId window, server-authoritative fraud, webhook verification, and integration checklist.
Playbook
Topics
Integration concepts
Core patterns every production deployment should follow.
Why server-side VPN detection beats IP lists alone
Timezone mismatch, relay detection, and visit history corroborate client VPN hints, IP rotation alone is insufficient.
Confidence is merge risk, not uniqueness
Gate signup and payouts on identification.confidence plus linkedId from Events GET, originId alone is a browser handle, not a person.
Limiter: identify-time blocks vs Events evaluation
Enabled rulesets auto-block abusive identify traffic; pass ruleset_id on Events GET when your backend needs inline ruleAction after identify.
Slim SDK responses and the 5-minute event window
Production keys never expose fraud fields in-browser; each eventId is authoritative for one server-side decision.