# Visitor identification

> What a Fingerly visitor ID is, how stable it is, what visitor confidence means, and how to use them to recognise returning devices.

Last updated: 2026-09-17

Every identification returns a `visitor_id`: a stable identifier for the device, resolved by the server. The same device returns the same visitor ID on its next visit, whether or not it kept its cookies.

## The visitor ID

- Twenty letters and digits, such as `X9pL2mRc7KvT4bQw8NdF`. Treat it as an opaque string.
- Issued by Fingerly and never derived from the device's data, so it reveals nothing about the device.
- **Scoped to your organization.** The same device on another customer's site has a different visitor ID. Visitor IDs cannot be used to follow people across companies.
- The same across your development, staging and production keys.
- Always present on a successful identification.

The ID is designed to survive the changes devices go through: browser and operating system updates, new fonts, a different monitor, travel between networks.

## Visitor confidence

`visitor_confidence` says how the ID was reached, from 0 to 100.

| Value | Meaning | How to treat it |
| --- | --- | --- |
| `100` | This exact device has been seen before. | A confident returning visitor. |
| `85` to `99` | Recognised after the device changed, such as after an update. | A returning visitor. Lower values mean more change. |
| `0` | Nothing matched, so a new visitor ID was issued. | A new visitor, or one Fingerly could not recognise. |

## New visitors

`visitor_is_new` is `true` the first time your organization sees a visitor. Use it for new-account and first-purchase decisions, such as whether a welcome offer should apply.

## When a device cannot be identified

Some browsers and clients give away almost nothing, whether through hardened privacy settings or deliberately. When there is too little to identify anyone, the response has `identifiable: false`:

- A fresh visitor ID is issued each time, so these clients appear as a stream of new visitors. Do not count them as returning or unique.
- The request is still scored, and the `fingerprint_suppressed` signal is added.
- A production request that is not identifiable costs $0.0005 instead of $0.003.

## Using visitor IDs

| Pattern | Example |
| --- | --- |
| Limit accounts per device | Refuse a fifth sign-up from one visitor ID in a day. |
| Recognise a returning customer | Skip a second factor for a known visitor with confidence `100` on their usual account. |
| Link accounts that share a device | Store the visitor ID with each account, and review accounts that share one. |
| Enforce one-per-customer offers | Allow one promotion redemption per visitor ID. |

> **Tip:** Store `visitor_id` alongside your own user, order or session records. Most of the value comes from joining it with what you already know.

> **Note:** A visitor ID identifies a device, not a person. Several people can share a device, and one person can use several.