fingerlydocs
fingerly.io Log inDashboard
Guides

Plan your integration

Decide where to identify, how to tag actions, which keys each environment needs, and how to roll out a risk policy without surprising real customers.

A good integration is a few decisions made up front. This page walks through them.

Where to identify

Identify at the moments that carry risk or value, not on every page view. Each production identification is billed.

MomentTagTypical decision
Sign-upsignupLimit accounts per visitor; review high-risk sign-ups.
LoginloginStep up to a second factor on medium; lock on high.
Checkoutcheckout:<order id>Hold high-risk orders for review.
Promotion redemptionpromo:<code>One redemption per visitor.
Password resetpassword-resetSlow down resets from new, high-risk visitors.

Tag every identification

A tag binds an identification to the action it was made for. When your server checks the tag, a request ID captured on a harmless page cannot be replayed at checkout. Include an identifier from the action itself, such as an order ID, where you have one.

Keys per environment

EnvironmentKeysBilledUse for
DevelopmentPublic and secretNoLaptops and CI.
StagingPublic and secretNoPre-release testing with realistic traffic.
ProductionPublic and secret, optionally a proxy keyYesReal visitors.

Each environment's events, dashboards and webhooks are kept apart, so test traffic never shows up in production numbers. See API keys and environments.

Roll out a policy

  1. Step 1: Observe

    Identify and store results without acting on them. Log what each level would have done.

  2. Step 2: Tune

    Review high and medium sessions in the dashboard. Adjust risk weights and the threshold until the levels match what you see.

  3. Step 3: Add friction first

    Act on medium with friction a real customer can pass, such as a second factor.

  4. Step 4: Enforce

    Act on high once you trust it: review, block, or limit.

Decide on the server

Always read results with a secret key on your backend. Anything the browser reports, including the score, can be changed by whoever controls the browser. See server-side verification.

The SDKs collect as soon as they are called, unless you load them with a consent state other than granted. If your legal basis requires consent, load with pending and pass on your consent tool's answer. See consent tools.

Checklist

  • Identification points chosen and tagged.
  • Public key origins list every production domain.
  • Secret key stored only on servers.
  • Server checks the tag, the age and the level.
  • Failures degrade to missing evidence, not errors.
  • Consent gate in place where required.

Last updated