# Changelog

> Changes to the Fingerly API, webhook events, signals and every SDK, newest first, with the version each change arrived in.

Last updated: 2026-09-17

Every change you might notice is recorded here: in the API, in webhook events, in signals and their default weights, and in each SDK. Entries are newest first. Deprecations are announced here too, under the [versioning policy](https://docs.fingerly.io/docs/versioning).

## Current versions

| Component | Version |
| --- | --- |
| [HTTP API](https://docs.fingerly.io/reference/overview) | `v1` |
| [Webhook envelope](https://docs.fingerly.io/reference/webhooks/envelope) | `1` |
| [JavaScript](https://docs.fingerly.io/docs/sdks/javascript), [React](https://docs.fingerly.io/docs/sdks/react), [Next.js](https://docs.fingerly.io/docs/sdks/nextjs), [Vue](https://docs.fingerly.io/docs/sdks/vue), [Nuxt](https://docs.fingerly.io/docs/sdks/nuxt), [Svelte](https://docs.fingerly.io/docs/sdks/svelte), [Angular](https://docs.fingerly.io/docs/sdks/angular) | 0.1.0 |
| [iOS](https://docs.fingerly.io/docs/sdks/ios), [Android](https://docs.fingerly.io/docs/sdks/android), [React Native](https://docs.fingerly.io/docs/sdks/react-native), [Flutter](https://docs.fingerly.io/docs/sdks/flutter), [Lynx](https://docs.fingerly.io/docs/sdks/lynx) | 0.1.0 |
| [Node.js](https://docs.fingerly.io/docs/sdks/node), [Python](https://docs.fingerly.io/docs/sdks/python), [Go](https://docs.fingerly.io/docs/sdks/go), [Java](https://docs.fingerly.io/docs/sdks/java), [.NET](https://docs.fingerly.io/docs/sdks/dotnet), [PHP](https://docs.fingerly.io/docs/sdks/php), [Ruby](https://docs.fingerly.io/docs/sdks/ruby), [Rust](https://docs.fingerly.io/docs/sdks/rust) | 0.1.0 |
| [Cloudflare Worker proxy](https://docs.fingerly.io/docs/sdks/cloudflare-worker) | 0.1.0 |

> **Tip:** Events record the SDK that sent each identification as `sdk_platform` and `sdk_version`. **Insights > Traffic** shows which versions are still in use.

## API

### v1

The first version of the API.

- Client API: [`POST /identify`](https://docs.fingerly.io/reference/identify), [`POST /events/{request_id}/supplement`](https://docs.fingerly.io/reference/deferred-report) and [`POST /attestation/challenge`](https://docs.fingerly.io/reference/attestation-challenge), with public keys.
- Server API: [`GET /events`](https://docs.fingerly.io/reference/list-events) and [`GET /events/{request_id}`](https://docs.fingerly.io/reference/get-event), with secret keys.
- Proxy keys and forwarded visitor headers for first-party proxies.
- `Idempotency-Key` on identify, and `RateLimit-Limit`, `RateLimit-Remaining`, `Retry-After` and `Fingerly-Balance-Micros` response headers, readable from browsers.
- Management API: SDK keys, proxy keys, webhook endpoints and risk weights, with management keys acting as `admin` or `developer`.
- Secret keys are refused from browsers on event reads as on identify, except development keys from the Try it panel on these docs.
- An [OpenAPI 3.1 document and a Postman collection](https://docs.fingerly.io/reference/openapi).

## Webhooks

### Envelope version 1

The first version of webhook events.

- Events: `identification.completed`, `visitor.suspect`, `identification.refused`, `billing.status_changed` and `usage.daily_settled`, and `webhook.test` from **Send test event**.
- HMAC-SHA256 signatures over the timestamp and the body, with secret rotation and an overlap window of up to seven days.
- Retries over about seven hours, redelivery from the delivery history, and pausing.

## Signals

### Initial signal groups

The signal groups in the [signals reference](https://docs.fingerly.io/docs/signals), with their default weights for web, Android and iOS, and a default threshold of `30`.

## Web SDKs

### 0.1.0

The first version of `@fingerly/web-js` and the React, Next.js, Vue, Nuxt, Svelte and Angular bindings.

- `identify()` with tags, a 300 ms initial collection and a deferred tier sent after the answer.
- Local verdicts, `submit: false` and `collect()`.
- First-party `endpoints`, with `fallbackToDefaultEndpoint`.
- Consent states: `consent`, `setConsent()`, `onConsentChange()` and `ConsentError`.
- Retries with one idempotency key, and `TransportError`.

## Mobile SDKs

### 0.1.0

The first version of the iOS and Android SDKs, and of the React Native, Flutter and Lynx packages over them.

- `identify` with tags, local verdicts, `submit: false` and `collect`.
- Hardware-backed attestation on Android 7.0 and newer.
- Consent states and `setConsent`.

## Server SDKs

### 0.1.0

The first version of the Node.js, Python, Go, Java, .NET, PHP, Ruby and Rust libraries.

- Read one event, and list events by window, visitor and level.
- Webhook signature verification, accepting any signature during a secret rotation.
- Node.js: `createProxy`, a first-party proxy for web `Request` and `Response` runtimes.

## Cloudflare Worker proxy

### 0.1.0

The first version of the Worker proxy: forwards identify and deferred-report requests for allowed origins, authenticated with a proxy key.