A Fingerly integration has two halves. A client SDK runs where the visitor is, collects signals and identifies them with a public key. A server SDK runs on your backend and reads the result with a secret key, so decisions are made on data the visitor cannot edit.
Web
Every web SDK is built on the JavaScript SDK. The framework bindings share one identification per page and are safe under server rendering.
Mobile
The native SDKs collect what only native code can reach. The cross-platform packages call them rather than collecting less.
Server
Server SDKs read events and verify webhooks, with the same calls in every language. Any other language can do both over the HTTP API with one request and one HMAC.
What every client SDK shares
| Guarantee | What it means for you |
|---|---|
| No permission prompts | No dialog, picker or permission request on any platform, for any signal. |
| A strict time budget | Collection stops at its budget. A slow or failing signal is recorded as such and never holds up the answer. |
| Never crashes your app | Every signal source is isolated. One that throws cannot take the report or your app with it. |
| One response shape | Browsers, iPhones and Android phones get the same fields back: request ID, visitor ID, score, level and triggers. |
| Retries once, charged once | Network failures, 429 and 5xx are retried with a single idempotency key. |
| Advisory local verdicts | Verdicts computed on the device help your interface. The server's score is the one to act on. |
Versions
Every SDK follows semantic versioning on its own schedule and targets version v1 of the API. SDKs report their version with every request, and events record it as sdk_platform and sdk_version, so the dashboard shows which builds are still in use.