[{"data":1,"prerenderedAt":323},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fdevice-fingerprinting-faq":3},{"page":4,"toc":272,"updated":322},{"path":5,"title":6,"seoTitle":7,"description":8,"blocks":9},"\u002Fdocs\u002Fdevice-fingerprinting-faq","Device fingerprinting FAQ for developers","Device Fingerprinting FAQ: Answers for Developers","Answers to the questions developers ask about device fingerprinting: how it works, accuracy and limits, privacy, bots and VPNs, integration and pricing.",[10,13,18,22,24,27,29,32,34,37,39,42,44,47,49,52,54,57,60,62,65,67,70,72,75,77,80,82,85,87,90,92,95,98,100,103,105,108,110,113,115,118,120,123,125,128,131,133,136,138,141,143,146,148,151,153,156,158,161,163,166,168,171,173,176,178,181,184,186,189,191,194,196,199,201,204,206,209,211,214,216,219,221,224,226,229,231,234,237,239,242,244,247,249],{"type":11,"text":12},"p","Short answers to the questions developers ask about **device fingerprinting** and Fingerly, grouped by topic. Each links to the page that has the detail. New to the idea? Start with [what device fingerprinting is](\u002Fdocs\u002Fdevice-fingerprinting).",{"type":14,"level":15,"text":16,"id":17},"heading",2,"The basics","the-basics",{"type":14,"level":19,"text":20,"id":21},3,"What is device fingerprinting?","what-is-device-fingerprinting",{"type":11,"text":23},"Device fingerprinting recognises a device from characteristics it already exposes, such as properties of its browser and operating system, instead of an identifier stored on it. A script or SDK reads the characteristics, a server compares them with what it has seen before, and the same device gets the same identifier on its next visit. See [what device fingerprinting is](\u002Fdocs\u002Fdevice-fingerprinting).",{"type":14,"level":19,"text":25,"id":26},"What is browser fingerprinting?","what-is-browser-fingerprinting",{"type":11,"text":28},"Browser fingerprinting is device fingerprinting for a web browser. Fingerly's JavaScript SDK sends what it reads to the server, which resolves a visitor ID, and nothing is stored in the browser. See [device fingerprinting vs cookies](\u002Fdocs\u002Fdevice-fingerprinting-vs-cookies).",{"type":14,"level":19,"text":30,"id":31},"What is a visitor ID?","what-is-a-visitor-id",{"type":11,"text":33},"A visitor ID is the stable identifier Fingerly issues for a device: twenty letters and digits, scoped to your organization. It is issued by Fingerly and never derived from the device's data, so it reveals nothing about the device. See [visitor identification](\u002Fdocs\u002Fvisitor-identification).",{"type":14,"level":19,"text":35,"id":36},"What is the difference between a device ID and a visitor ID?","what-is-the-difference-between-a-device-id-and-a-visitor-id",{"type":11,"text":38},"\"Device ID\" is the everyday name for an identifier of a device. Fingerly's is the visitor ID. It is not a hardware identifier: apps are recognised by a random install ID the SDK keeps, and SDKs never read identifiers such as the advertising identifier or `ANDROID_ID`.",{"type":14,"level":19,"text":40,"id":41},"What is device intelligence?","what-is-device-intelligence",{"type":11,"text":43},"Device intelligence is what you learn about a device and session from one identification: a stable visitor ID, a suspect score and level, network context such as country and anonymising networks, and, on your backend, the signals behind the score. See [how Fingerly works](\u002Fdocs\u002Fhow-it-works).",{"type":14,"level":19,"text":45,"id":46},"What is a suspect score?","what-is-a-suspect-score",{"type":11,"text":48},"The suspect score is the sum of the weights of the signals that fired in a session, such as a Tor connection or an automated browser. It is not a percentage and has no maximum. Compared with your threshold, it gives a level of `low`, `medium` or `high`. See [suspect score](\u002Fdocs\u002Fsuspect-score).",{"type":14,"level":19,"text":50,"id":51},"How long does an identification take?","how-long-does-an-identification-take",{"type":11,"text":53},"In a browser, `identify()` typically resolves within a few hundred milliseconds. The initial collection is capped at 300 ms, and slower signals follow for up to 1,200 ms more as a deferred report that never changes the answer. The mobile SDKs collect within a default budget of 1,200 ms.",{"type":14,"level":15,"text":55,"id":56},"Accuracy and limits","accuracy-and-limits",{"type":14,"level":19,"text":58,"id":59},"Is device fingerprinting accurate?","is-device-fingerprinting-accurate",{"type":11,"text":61},"Fingerly reports how sure each match is rather than a single accuracy figure. `visitor_confidence` runs from 0 to 100: `100` means this exact device was seen before, `85` to `99` that it was recognised after it changed, and `0` that nothing matched. Treat every answer as evidence for your own rules, not a verdict. See [visitor identification](\u002Fdocs\u002Fvisitor-identification#visitor-confidence).",{"type":14,"level":19,"text":63,"id":64},"Can device fingerprinting be spoofed?","can-device-fingerprinting-be-spoofed",{"type":11,"text":66},"A determined attacker who controls a browser or a device can change what it sends. Fingerly raises signals when a runtime has been modified or claims to be something it is not, and on mobile, hardware attestation raises the cost of forging a report. Neither makes forgery impossible, which is why you decide on your server and tune the response. See [mobile app attestation](\u002Fdocs\u002Fmobile-attestation).",{"type":14,"level":19,"text":68,"id":69},"Does device fingerprinting work in incognito or private mode?","does-device-fingerprinting-work-in-incognito-or-private-mode",{"type":11,"text":71},"The browser SDK keeps nothing in the browser, so it does not depend on cookies or storage that a private window starts empty. A private window is also reported as the `incognito_mode` signal, which adds to the score. How well a given browser can be matched depends on what it exposes, and a browser that gives too little comes back `identifiable: false`.",{"type":14,"level":19,"text":73,"id":74},"Does device fingerprinting work on mobile apps?","does-device-fingerprinting-work-on-mobile-apps",{"type":11,"text":76},"Yes, with the iOS and Android SDKs, not the browser SDK. In apps the device is recognised by a random install ID the SDK keeps, and device signals feed the integrity checks and the score. On iOS the ID survives a reinstall, and on Android a reinstall gets a new visitor ID. See [what device fingerprinting is](\u002Fdocs\u002Fdevice-fingerprinting#web-and-native-apps).",{"type":14,"level":19,"text":78,"id":79},"Can device fingerprinting identify a person?","can-device-fingerprinting-identify-a-person",{"type":11,"text":81},"No. A visitor ID identifies a device. Several people can share one device, and one person can use several. Visitor IDs are also scoped to your organization, so Fingerly does not link them across customers.",{"type":14,"level":19,"text":83,"id":84},"What happens when a device cannot be identified?","what-happens-when-a-device-cannot-be-identified",{"type":11,"text":86},"The response has `identifiable: false`, the device gets a fresh visitor ID each time, the `fingerprint_suppressed` signal fires, and the request is still scored and is free. Do not count these as returning or unique visitors.",{"type":14,"level":19,"text":88,"id":89},"Does a VPN change the visitor ID?","does-a-vpn-change-the-visitor-id",{"type":11,"text":91},"A VPN changes the network, not the device, and the browser visitor ID is designed to survive travel between networks. A VPN is reported separately, in `anonymity_network` and the `vpn` signal group.",{"type":14,"level":15,"text":93,"id":94},"Privacy and legal","privacy-and-legal",{"type":14,"level":19,"text":96,"id":97},"Is device fingerprinting legal?","is-device-fingerprinting-legal",{"type":11,"text":99},"It depends on where your visitors are, what you use it for and your lawful basis, and nothing in these docs is legal advice. Fingerly collects nothing until you pass `consent: granted`, so you can gate it behind your consent flow. See [privacy and consent](\u002Fdocs\u002Fprivacy-and-consent).",{"type":14,"level":19,"text":101,"id":102},"Do I need consent to use Fingerly?","do-i-need-consent-to-use-fingerly",{"type":11,"text":104},"Whether you need consent, and for what, depends on your lawful basis and where your visitors are. Every SDK takes a `consent` option that defaults to `pending`, and until it is `granted` the SDK reads and sends nothing. See [consent tools](\u002Fdocs\u002Fconsent-tools) for wiring it to a consent banner.",{"type":14,"level":19,"text":106,"id":107},"Does Fingerly use cookies?","does-fingerly-use-cookies",{"type":11,"text":109},"No. The browser SDK sets no cookies and keeps nothing in the browser beyond one test value it writes to check that storage works and removes at once. Requests are sent without credentials, and responses set none.",{"type":14,"level":19,"text":111,"id":112},"What data does Fingerly collect?","what-data-does-fingerly-collect",{"type":11,"text":114},"Characteristics of the device, operating system and browser or app, the visitor's IP address for an approximate location and network checks, your tag and the time of the request, and on iOS and Android a random install ID. It never collects page content, anything a visitor types, keystrokes or anything behind a permission prompt. See [privacy and consent](\u002Fdocs\u002Fprivacy-and-consent#what-is-collected).",{"type":14,"level":19,"text":116,"id":117},"Does Fingerly track people across websites?","does-fingerly-track-people-across-websites",{"type":11,"text":119},"No. A visitor ID is scoped to your organization, so the same device has a different visitor ID on another customer's site. Fingerly does not link visitors across organizations or use visitor data for advertising.",{"type":14,"level":19,"text":121,"id":122},"How long is data kept, and how do I erase it?","how-long-is-data-kept-and-how-do-i-erase-it",{"type":11,"text":124},"Events are readable with a secret key for 30 days. To erase an app's stored identity, call `deleteStoredIdentity()` in the SDK, and to erase a visitor use the [management API](\u002Freference\u002Fmanagement\u002Fvisitors). See [data retention](\u002Fdocs\u002Fdata-retention).",{"type":14,"level":15,"text":126,"id":127},"Fraud, bots and networks","fraud-bots-and-networks",{"type":14,"level":19,"text":129,"id":130},"How do I detect bots?","how-do-i-detect-bots",{"type":11,"text":132},"Read `visitor_kind` on the stored event, which is `human`, `ai_bot`, `automation` or `search_crawler`, and check whether the `bot` signal group fired. Both come from the same identification as the visitor ID. See [bot, VPN and Tor detection](\u002Fdocs\u002Fbot-and-vpn-detection).",{"type":14,"level":19,"text":134,"id":135},"How do I detect VPN, proxy and Tor users?","how-do-i-detect-vpn-proxy-and-tor-users",{"type":11,"text":137},"`anonymity_network` on the stored event is `tor`, `vpn`, `proxy` or `hosting`, and it is omitted for an ordinary connection. The `asn`, `asn_name` and `country_code` fields say whose network it is, and the `tor`, `vpn`, `datacenter_proxy` and `residential_proxy` groups appear in `triggers`.",{"type":14,"level":19,"text":139,"id":140},"Should I block VPN traffic?","should-i-block-vpn-traffic",{"type":11,"text":142},"A VPN is not evidence of fraud by itself, because many customers use one for ordinary reasons. Fingerly gives it a modest default weight, and you set what it is worth with [risk weights](\u002Fdocs\u002Frisk-weights). Combine it with other signals and the level, and add friction before you refuse.",{"type":14,"level":19,"text":144,"id":145},"How do I detect multiple accounts?","how-do-i-detect-multiple-accounts",{"type":11,"text":147},"Identify at sign-up, store the visitor ID with each account, and count accounts per visitor ID in your own database. See [detect multiple accounts](\u002Fdocs\u002Fdetect-multiple-accounts).",{"type":14,"level":19,"text":149,"id":150},"How do I stop fake signups and promo abuse?","how-do-i-stop-fake-signups-and-promo-abuse",{"type":11,"text":152},"Limit accounts and redemptions per device rather than per email address, and send automated or farmed sign-ups to verification or review. See [sign-up abuse](\u002Fdocs\u002Fuse-cases\u002Fsign-up-abuse) and [prevent promo abuse](\u002Fdocs\u002Fprevent-promo-abuse).",{"type":14,"level":19,"text":154,"id":155},"How do I prevent account takeover and credential stuffing?","how-do-i-prevent-account-takeover-and-credential-stuffing",{"type":11,"text":157},"Refuse automation, count failed logins and accounts per visitor ID, and challenge logins from devices an account has never used. See [prevent account takeover](\u002Fdocs\u002Fprevent-account-takeover).",{"type":14,"level":19,"text":159,"id":160},"How do I detect emulators, rooted and jailbroken devices?","how-do-i-detect-emulators-rooted-and-jailbroken-devices",{"type":11,"text":162},"The iOS and Android SDKs collect raw input and the server derives signals such as `android_emulator`, `ios_simulator`, `rooted_device` and `jailbroken_device`, which you read on the stored event. See [detect emulators, rooted and jailbroken devices](\u002Fdocs\u002Fdetect-emulators-root-jailbreak).",{"type":14,"level":19,"text":164,"id":165},"Is device fingerprinting a CAPTCHA alternative?","is-device-fingerprinting-a-captcha-alternative",{"type":11,"text":167},"It is a way to decide who needs one. Fingerly runs no challenge and shows the visitor nothing. It scores the session, so you can add a CAPTCHA or a second factor only for `medium` sessions and let the rest through.",{"type":14,"level":19,"text":169,"id":170},"How is device fingerprinting different from an IP address?","how-is-device-fingerprinting-different-from-an-ip-address",{"type":11,"text":172},"An address says which network a request came from, and it changes with a VPN, a mobile network or a proxy. A visitor ID says which device it is, and it is designed to survive changes of network. Fingerly reports both, and you can count per device where an address limit would be bypassed.",{"type":14,"level":19,"text":174,"id":175},"Is a visitor ID a replacement for authentication?","is-a-visitor-id-a-replacement-for-authentication",{"type":11,"text":177},"No. A visitor ID is a signal for your own rules, not a credential. Keep authenticating people the way you do now, and use the visitor ID to decide how much friction a login or a payment gets.",{"type":14,"level":15,"text":179,"id":180},"Integration","integration",{"type":14,"level":19,"text":182,"id":183},"How do I implement device fingerprinting?","how-do-i-implement-device-fingerprinting",{"type":11,"text":185},"Create a public and a secret key, add an SDK to your page or app, call `identify()` with a tag at the moments that matter, send the request ID to your server, and read the stored event with the secret key. The [quick start](\u002Fdocs\u002Fquick-start) takes about five steps.",{"type":14,"level":19,"text":187,"id":188},"Which frameworks and languages are supported?","which-frameworks-and-languages-are-supported",{"type":11,"text":190},"For the web: JavaScript, React, Next.js, Vue, Nuxt, Svelte and Angular. For apps: iOS (Swift), Android (Kotlin), React Native, Flutter and Lynx. On the server: Node.js, Python, Go, Java, .NET, PHP, Ruby and Rust, and any other language through the HTTP API. See [choosing an SDK](\u002Fdocs\u002Fsdks).",{"type":14,"level":19,"text":192,"id":193},"Why must I verify the result on my server?","why-must-i-verify-the-result-on-my-server",{"type":11,"text":195},"Anything a browser or an app returns can be edited by whoever controls it. Your backend reads the stored event with a secret key and checks that it exists, belongs to this action, is recent and passes your policy. See [server-side verification](\u002Fdocs\u002Fserver-side-verification).",{"type":14,"level":19,"text":197,"id":198},"What is a request ID?","what-is-a-request-id",{"type":11,"text":200},"A request ID is the ID of one identification, a UUIDv7. The client sends it to your server with the action, and your server reads the stored event with it. See the [glossary](\u002Fdocs\u002Fglossary#request-id).",{"type":14,"level":19,"text":202,"id":203},"Do ad blockers affect it?","do-ad-blockers-affect-it",{"type":11,"text":205},"Content blockers refuse requests to third-party hosts and to paths they know. A first-party proxy serves the SDK's submissions from your own domain at a random path that is unique to it, which gets past them. See [proxy integrations](\u002Fdocs\u002Fproxy-integrations).",{"type":14,"level":19,"text":207,"id":208},"What happens if the SDK cannot identify a visitor?","what-happens-if-the-sdk-cannot-identify-a-visitor",{"type":11,"text":210},"Let the visitor continue. Your server receives no request ID and treats that as missing evidence, for example by asking for verification, rather than as proof of fraud or of innocence. Never make an identification failure fatal.",{"type":14,"level":19,"text":212,"id":213},"Can I try it without paying?","can-i-try-it-without-paying",{"type":11,"text":215},"Yes. Development and staging keys run the same detection as production and cost nothing, and new accounts start with $1 of credit. See [API keys and environments](\u002Fdocs\u002Fapi-keys).",{"type":14,"level":19,"text":217,"id":218},"Can I get results pushed to my server?","can-i-get-results-pushed-to-my-server",{"type":11,"text":220},"Yes. [Webhooks](\u002Fdocs\u002Fwebhooks) send every identification, high-risk visitors, refusals and billing changes as signed HTTPS requests, so you can keep your own copy and react without polling.",{"type":14,"level":19,"text":222,"id":223},"Is there an OpenAPI description or a Postman collection?","is-there-an-openapi-description-or-a-postman-collection",{"type":11,"text":225},"Yes. See [OpenAPI and Postman](\u002Freference\u002Fopenapi). The documentation is also available as Markdown, and as `llms.txt` and `llms-full.txt` for AI assistants.",{"type":14,"level":19,"text":227,"id":228},"Should I build device fingerprinting myself or buy it?","should-i-build-device-fingerprinting-myself-or-buy-it",{"type":11,"text":230},"Building means collecting across browsers and operating systems, resolving identities on a server, scoring, network intelligence, attestation on mobile, and keeping up as browsers change. Buying means paying per request instead. Decide on how much of that you want to own, and note that Fingerly has no plans or minimums to commit to.",{"type":14,"level":15,"text":232,"id":233},"Pricing","pricing",{"type":14,"level":19,"text":235,"id":236},"How much does device fingerprinting cost with Fingerly?","how-much-does-device-fingerprinting-cost-with-fingerly",{"type":11,"text":238},"A production identification costs $0.0025 per request, graduated by volume: $0.0025 for the first 250,000 in a month, $0.0020 from 250,000 to 1,000,000, and $0.0015 beyond. Fingerly is prepaid, with no plans, minimums, monthly fees or seat charges. See [billing and usage](\u002Fdocs\u002Fbilling).",{"type":14,"level":19,"text":240,"id":241},"What is free?","what-is-free",{"type":11,"text":243},"Requests with a development or staging key, production requests that could not identify a device, requests Fingerly refuses, requests whose network lookup could not run, deferred reports, attestation challenges, reading events and webhooks. Only identifiable production checks are charged.",{"type":14,"level":19,"text":245,"id":246},"What happens when my credit runs out?","what-happens-when-my-credit-runs-out",{"type":11,"text":248},"Identification continues below zero up to a tolerance, and then production requests are refused with `402 no_credit` until you add funds. Turn on auto top-up to add a fixed amount by card when the balance falls below a threshold. Watch the `identification.refused` webhook so it never stops unnoticed.",{"type":250,"columns":15,"cards":251},"cards",[252,257,262,267],{"title":253,"text":254,"href":255,"icon":256},"Quick start","Get a visitor ID and verify it on your server.","\u002Fdocs\u002Fquick-start","bolt",{"title":258,"text":259,"href":260,"icon":261},"Glossary","Every term the docs and the API use.","\u002Fdocs\u002Fglossary","list",{"title":263,"text":264,"href":265,"icon":266},"Use cases","Recipes for each kind of fraud.","\u002Fdocs\u002Fuse-cases","lightbulb",{"title":268,"text":269,"href":270,"icon":271},"Choosing an SDK","Web, mobile and server SDKs.","\u002Fdocs\u002Fsdks","package",[273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321],{"id":17,"text":16,"level":15},{"id":21,"text":20,"level":19},{"id":26,"text":25,"level":19},{"id":31,"text":30,"level":19},{"id":36,"text":35,"level":19},{"id":41,"text":40,"level":19},{"id":46,"text":45,"level":19},{"id":51,"text":50,"level":19},{"id":56,"text":55,"level":15},{"id":59,"text":58,"level":19},{"id":64,"text":63,"level":19},{"id":69,"text":68,"level":19},{"id":74,"text":73,"level":19},{"id":79,"text":78,"level":19},{"id":84,"text":83,"level":19},{"id":89,"text":88,"level":19},{"id":94,"text":93,"level":15},{"id":97,"text":96,"level":19},{"id":102,"text":101,"level":19},{"id":107,"text":106,"level":19},{"id":112,"text":111,"level":19},{"id":117,"text":116,"level":19},{"id":122,"text":121,"level":19},{"id":127,"text":126,"level":15},{"id":130,"text":129,"level":19},{"id":135,"text":134,"level":19},{"id":140,"text":139,"level":19},{"id":145,"text":144,"level":19},{"id":150,"text":149,"level":19},{"id":155,"text":154,"level":19},{"id":160,"text":159,"level":19},{"id":165,"text":164,"level":19},{"id":170,"text":169,"level":19},{"id":175,"text":174,"level":19},{"id":180,"text":179,"level":15},{"id":183,"text":182,"level":19},{"id":188,"text":187,"level":19},{"id":193,"text":192,"level":19},{"id":198,"text":197,"level":19},{"id":203,"text":202,"level":19},{"id":208,"text":207,"level":19},{"id":213,"text":212,"level":19},{"id":218,"text":217,"level":19},{"id":223,"text":222,"level":19},{"id":228,"text":227,"level":19},{"id":233,"text":232,"level":15},{"id":236,"text":235,"level":19},{"id":241,"text":240,"level":19},{"id":246,"text":245,"level":19},"2026-11-12T11:59:51.000Z",1794493377152]