Changelog

Every change you might notice is recorded here: in the API, in webhook events, in signals and their default weights, and in each SDK. Entries are newest first. Deprecations are announced here too, under the versioning policy.

Current versions

API

v1

The first version of the API.

• Client API: POST /identify, POST /events/{request_id}/supplement and POST /attestation/challenge, with public keys.
• Server API: GET /events and GET /events/{request_id}, with secret keys.
• Proxy keys and forwarded visitor headers for first-party proxies.
• Idempotency-Key on identify, and RateLimit-Limit, RateLimit-Remaining, Retry-After and Fingerly-Balance-Micros response headers, readable from browsers.
• Management API: SDK keys, proxy keys, webhook endpoints and risk weights, with management keys acting as admin or developer.
• Secret keys are refused from browsers on event reads as on identify, except development keys from the Try it panel on these docs.
• An OpenAPI 3.1 document and a Postman collection.

Webhooks

Envelope version 1

The first version of webhook events.

• Events: identification.completed, visitor.suspect, identification.refused, billing.status_changed and usage.daily_settled, and webhook.test from Send test event.
• HMAC-SHA256 signatures over the timestamp and the body, with secret rotation and an overlap window of up to seven days.
• Retries over about seven hours, redelivery from the delivery history, and pausing.

Signals

Initial signal groups

The signal groups in the signals reference, with their default weights for web, Android and iOS, and a default threshold of 30.

Web SDKs

0.1.0

The first version of @fingerly/web-js and the React, Next.js, Vue, Nuxt, Svelte and Angular bindings.

• identify() with tags, a 300 ms initial collection and a deferred tier sent after the answer.
• Local verdicts, submit: false and collect().
• First-party endpoints, with fallbackToDefaultEndpoint.
• Consent states: consent, setConsent(), onConsentChange() and ConsentError.
• Retries with one idempotency key, and TransportError.

Mobile SDKs

0.1.0

The first version of the iOS and Android SDKs, and of the React Native, Flutter and Lynx packages over them.

• identify with tags, local verdicts, submit: false and collect.
• Hardware-backed attestation on Android 7.0 and newer.
• Consent states and setConsent.

Server SDKs

0.1.0

The first version of the Node.js, Python, Go, Java, .NET, PHP, Ruby and Rust libraries.

• Read one event, and list events by window, visitor and level.
• Webhook signature verification, accepting any signature during a secret rotation.
• Node.js: createProxy, a first-party proxy for web Request and Response runtimes.

Cloudflare Worker proxy

0.1.0

The first version of the Worker proxy: forwards identify and deferred-report requests for allowed origins, authenticated with a proxy key.