# Fingerly Docs > Fingerly identifies the device behind every web and mobile session and scores how suspicious it is. These docs cover the client and server SDKs, the HTTP API, webhooks, signals and the suspect score. The complete documentation in one file: https://docs.fingerly.io/llms-full.txt ## Guides: Get started - [Introduction](https://docs.fingerly.io/docs/introduction.md): Fingerly identifies the device behind every session and scores how suspicious it is, so your application can stop fraud without adding friction for real people. - [Quick start](https://docs.fingerly.io/docs/quick-start.md): Create keys, identify a visitor in the browser, read the result with a secret key on your server, and act on it. The whole integration in five steps. - [How Fingerly works](https://docs.fingerly.io/docs/how-it-works.md): Follow one identification from the SDK collecting signals, through identification and scoring on the server, to the stored event, the webhook and your decision. - [Plan your integration](https://docs.fingerly.io/docs/planning-your-integration.md): Decide where to identify, how to tag actions, which keys each environment needs, and how to roll out a risk policy without surprising real customers. - [Migrate from FingerprintJS Pro](https://docs.fingerly.io/docs/migrate-from-fingerprintjs.md): Move a FingerprintJS Pro integration to Fingerly: map get() to identify(), Smart Signals to signal groups, and their webhooks to Fingerly webhooks, without downtime. ## Guides: Core concepts - [Visitor identification](https://docs.fingerly.io/docs/visitor-identification.md): What a Fingerly visitor ID is, how stable it is, what visitor confidence means, and how to use them to recognise returning devices. - [Suspect score](https://docs.fingerly.io/docs/suspect-score.md): How the suspect score is calculated from weighted signals, how levels are derived from your threshold, and why an unscored request is not a zero. - [Signals reference](https://docs.fingerly.io/docs/signals.md): Every signal group Fingerly scores on web, Android and iOS: what each means, its key in API responses and webhooks, and its default weight. - [Risk weights](https://docs.fingerly.io/docs/risk-weights.md): Change what each signal is worth and where the high level starts, for your whole organization or for a single key, without redeploying anything. - [Client-side verdicts](https://docs.fingerly.io/docs/client-verdicts.md): The verdicts each SDK computes on the device, what they are good for, and why decisions should still be made on your server. ## Guides: Integrate with your server - [Server-side verification](https://docs.fingerly.io/docs/server-side-verification.md): Never trust a result the browser reports. Read the stored event by request ID with a secret key, check it belongs to this action, then decide. - [Webhooks](https://docs.fingerly.io/docs/webhooks.md): Receive identifications, high-risk visitors, refusals, billing changes and daily usage as signed HTTPS requests to your server, the moment they happen. - [Reading events](https://docs.fingerly.io/docs/reading-events.md): Read identification events with a secret key: one event by request ID, or a window of events filtered by visitor or level, for up to 30 days. ## Guides: Use cases - [Use cases](https://docs.fingerly.io/docs/use-cases.md): End-to-end recipes for account takeover, credential stuffing, sign-up abuse, promotion abuse and payment fraud: where to identify, what to tag and what to decide. - [Account takeover](https://docs.fingerly.io/docs/use-cases/account-takeover.md): Remember the devices each account uses, let them through with little friction, and challenge logins, resets and payouts from new or suspicious devices. - [Credential stuffing](https://docs.fingerly.io/docs/use-cases/credential-stuffing.md): Stop scripts that replay leaked passwords against your login: refuse automation, and limit failed attempts and accounts per device instead of per address. - [Sign-up abuse](https://docs.fingerly.io/docs/use-cases/sign-up-abuse.md): Limit how many accounts one device can create, and send sign-ups from device farms, emulators and automation to verification or review. - [Promotion abuse](https://docs.fingerly.io/docs/use-cases/promotion-abuse.md): Enforce one redemption per device for coupons, referral rewards and free trials, however many accounts or email addresses the device uses. - [Payment fraud](https://docs.fingerly.io/docs/use-cases/payment-fraud.md): Score every checkout, step up risky payments, hold high-risk orders for review, stop card testing per device, and keep evidence for chargeback disputes. ## Guides: Test and troubleshoot - [Test your integration](https://docs.fingerly.io/docs/testing.md): Mock the SDK in unit and component tests, run end-to-end tests with development keys in automated browsers, and check a policy change before it reaches production. - [Troubleshooting](https://docs.fingerly.io/docs/troubleshooting.md): Fix the problems integrations run into: 401 and CORS errors, content blockers, events that cannot be read, visitor IDs that change, high scores and slow identification. ## Guides: Protect your implementation - [Proxy integrations](https://docs.fingerly.io/docs/proxy-integrations.md): Route the browser SDK through a path on your own domain so content blockers do not stop identification, without losing the visitor's real network signals. - [Content Security Policy](https://docs.fingerly.io/docs/content-security-policy.md): The Content Security Policy directives the browser SDK needs: which hosts to allow, and what it never requires. - [Mobile app attestation](https://docs.fingerly.io/docs/mobile-attestation.md): How Fingerly checks that a mobile report comes from your genuine app on a genuine device: hardware-backed attestation on Android, and integrity signals on iOS. ## Guides: Account and platform - [API keys and environments](https://docs.fingerly.io/docs/api-keys.md): Create public and secret keys for development, staging and production, restrict public keys to your origins, and keep test traffic apart from real traffic. - [Regions and data residency](https://docs.fingerly.io/docs/regions.md): Choose where your visitors' data lives. Each organization belongs to one region, and identification data never leaves it. - [Billing and usage](https://docs.fingerly.io/docs/billing.md): Prepaid, pay-as-you-go pricing: what an identification costs, what is free, how credit and auto top-up work, and what happens when the balance runs out. - [Rate limits](https://docs.fingerly.io/docs/rate-limits.md): How identification is rate limited per organization, what a 429 looks like, and how the SDKs and your code should respond. - [Team and roles](https://docs.fingerly.io/docs/team-and-roles.md): Invite your team to an organization and give each person a role: owner, admin, developer or billing. - [Using the dashboard](https://docs.fingerly.io/docs/dashboard.md): A tour of the Fingerly dashboard: identification events and visitors, signals and the suspect score, insights, integration settings and billing. ## Guides: Privacy and compliance - [Privacy and consent](https://docs.fingerly.io/docs/privacy-and-consent.md): What Fingerly collects and what it never does, your role and Fingerly's under data protection law, and how to gate the SDK behind consent where you need it. - [Consent tools](https://docs.fingerly.io/docs/consent-tools.md): Gate identification behind your consent tool: load the SDK with consent pending, then pass on the answer from OneTrust, Cookiebot, Google Consent Mode or your own banner. - [App Store and Google Play privacy](https://docs.fingerly.io/docs/app-store-privacy.md): How to answer Apple's App Privacy questions and Google Play's Data safety form for the data the Fingerly iOS, Android and cross-platform SDKs collect. - [Data retention](https://docs.fingerly.io/docs/data-retention.md): How long Fingerly keeps identification events, aggregated analytics, usage records and webhook deliveries, and how to keep your own copy for longer. - [Security](https://docs.fingerly.io/docs/security.md): How Fingerly protects your keys, webhook secrets and visitor data, what stays in your region, what you are responsible for, and how to report a vulnerability. - [Browser and device support](https://docs.fingerly.io/docs/browser-and-device-support.md): The browsers, operating systems, frameworks and server runtimes Fingerly SDKs support, and how privacy-focused browsers are handled. ## Guides: Resources - [Glossary](https://docs.fingerly.io/docs/glossary.md): Definitions of the terms used across Fingerly: visitor, identification, event, request ID, signal, group, trigger, weight, score, level and more. - [Changelog](https://docs.fingerly.io/docs/changelog.md): Changes to the Fingerly API, webhook events, signals and every SDK, newest first, with the version each change arrived in. - [Versioning and support](https://docs.fingerly.io/docs/versioning.md): How the API, webhooks, signals and SDKs are versioned, what counts as a breaking change, how long old versions are supported, and how deprecations are announced. ## SDKs: Overview - [Choosing an SDK](https://docs.fingerly.io/docs/sdks.md): Fingerly SDKs for the browser, six web frameworks, iOS, Android, React Native, Flutter, Lynx, and eight server languages. Which to use, and how they fit together. ## SDKs: Web - [JavaScript](https://docs.fingerly.io/docs/sdks/javascript.md): Install the browser SDK, identify a visitor at the moments that matter, and send the request ID to your server. Works with any framework, or none. - [React](https://docs.fingerly.io/docs/sdks/react.md): A provider and two hooks for React 19. One shared identification per page, server-rendering safe, with the result as plain state. - [Next.js](https://docs.fingerly.io/docs/sdks/nextjs.md): Identify visitors in Next.js 15 and newer. A provider that works from a Server Component layout, a hidden form field, and a Server Action helper that reads it. - [Vue](https://docs.fingerly.io/docs/sdks/vue.md): A plugin and composables for Vue 3.3 and newer. One shared identification per app, readonly reactive state, and safe under server rendering. - [Nuxt](https://docs.fingerly.io/docs/sdks/nuxt.md): A Nuxt module for Nuxt 3 and 4. Configure the key in nuxt.config or the environment, then use auto-imported composables in any component. - [Svelte](https://docs.fingerly.io/docs/sdks/svelte.md): Identify visitors in Svelte 5 and SvelteKit. Context-based setup, one shared identification per component tree, and reactive getters. - [Angular](https://docs.fingerly.io/docs/sdks/angular.md): Identify visitors in Angular 19 and newer with environment providers and signal-based injection functions. Zoneless and server-rendering safe. ## SDKs: Mobile - [iOS](https://docs.fingerly.io/docs/sdks/ios.md): Identify iPhones and iPads with the native Swift SDK. No dependencies, no permission prompts, and jailbreak, simulator and tampering verdicts on the device. - [Android](https://docs.fingerly.io/docs/sdks/android.md): Identify Android devices with the native Kotlin SDK. One dependency, two install-time permissions, hardware-backed attestation, and verdicts on the device. - [React Native](https://docs.fingerly.io/docs/sdks/react-native.md): Identify devices in React Native apps through the native iOS and Android SDKs, with one TypeScript API and the same verdicts on both platforms. - [Flutter](https://docs.fingerly.io/docs/sdks/flutter.md): Identify devices in Flutter apps through the native iOS and Android SDKs, with a typed Dart API and the same verdicts on both platforms. - [Lynx](https://docs.fingerly.io/docs/sdks/lynx.md): Identify devices in Lynx apps on iOS and Android through a native module over the Fingerly mobile SDKs. ## SDKs: Server - [Node.js](https://docs.fingerly.io/docs/sdks/node.md): Read identification events with a secret key, verify signed webhooks, and serve the browser SDK from your own domain with the Fingerly Node.js SDK. - [Python](https://docs.fingerly.io/docs/sdks/python.md): Read identification events with a secret key and verify signed webhooks from Python, with a synchronous client and an asyncio client that share one API. - [Go](https://docs.fingerly.io/docs/sdks/go.md): Read identification events with a secret key and verify signed webhooks from Go, with context-aware calls and typed events. - [Java](https://docs.fingerly.io/docs/sdks/java.md): Read identification events with a secret key and verify signed webhooks from Java 11 and newer, and from Kotlin and Scala on the JVM. - [.NET](https://docs.fingerly.io/docs/sdks/dotnet.md): Read identification events with a secret key and verify signed webhooks from .NET 6 and newer, with async APIs and dependency injection. - [PHP](https://docs.fingerly.io/docs/sdks/php.md): Read identification events with a secret key and verify signed webhooks from PHP 8.1 and newer, with Laravel and Symfony examples. - [Ruby](https://docs.fingerly.io/docs/sdks/ruby.md): Read identification events with a secret key and verify signed webhooks from Ruby 3.1 and newer, with a Rails example. - [Rust](https://docs.fingerly.io/docs/sdks/rust.md): Read identification events with a secret key and verify signed webhooks from Rust, with an async client built on Tokio and typed events. ## SDKs: Edge - [Cloudflare Worker proxy](https://docs.fingerly.io/docs/sdks/cloudflare-worker.md): Deploy a first-party proxy for the browser SDK in your own Cloudflare account. It forwards only identify requests, strips cookies and caps request bodies. ## API reference: Using the API - [API overview](https://docs.fingerly.io/reference/overview.md): The Fingerly HTTP API: regional base URLs, the two kinds of key, JSON conventions, and the endpoints your SDKs and your server call. - [Authentication](https://docs.fingerly.io/reference/authentication.md): Every API request is authenticated with a key in the x-api-key header. Which key you send decides what the request may do and where it may come from. - [Errors](https://docs.fingerly.io/reference/errors.md): How the Fingerly API reports errors: one JSON error shape, conventional HTTP statuses, and stable error codes you can branch on. - [Idempotency and retries](https://docs.fingerly.io/reference/idempotency.md): Retry an identification safely: the Idempotency-Key header makes a repeated request return the first answer, charged once. - [OpenAPI and Postman](https://docs.fingerly.io/reference/openapi.md): Download the OpenAPI 3.1 description of the Fingerly API and a Postman collection generated from it, to explore the API or generate a client. ## API reference: Server API - [List events](https://docs.fingerly.io/reference/list-events.md): List identification events in a time window, newest first, filtered by visitor or suspect level. - [Get an event](https://docs.fingerly.io/reference/get-event.md): Read one identification event by its request ID with a secret key. This is how your server verifies what a client reported. ## API reference: Client API - [Identify a visitor](https://docs.fingerly.io/reference/identify.md): Submit an SDK signal report and receive the visitor ID, the suspect score and the signals behind it in the same response. - [Submit a deferred report](https://docs.fingerly.io/reference/deferred-report.md): Attach the signals an SDK collects after its initial budget to an identification that has already been answered. - [Request an attestation challenge](https://docs.fingerly.io/reference/attestation-challenge.md): Issue a one-time, five-minute challenge that the Android SDK has the device keystore attest to, proving the report is fresh. ## API reference: Management API - [Management API](https://docs.fingerly.io/reference/management/overview.md): Manage SDK keys, proxy keys, webhook endpoints and risk weights from code, with a management key, for infrastructure as code and automation. - [SDK keys](https://docs.fingerly.io/reference/management/sdk-keys.md): List, issue and revoke public and secret SDK keys, and replace a public key's allowed origins, with a management key. - [Proxy keys](https://docs.fingerly.io/reference/management/proxy-keys.md): List, issue and revoke the proxy keys your first-party proxies authenticate with. Admin management keys only. - [Webhook endpoints](https://docs.fingerly.io/reference/management/webhooks.md): Create, update, pause and delete webhook endpoints, rotate their signing secrets, send test events and redeliveries, and read delivery attempts. - [Risk weights](https://docs.fingerly.io/reference/management/risk-weights.md): Read, save and restore suspect-score weights and thresholds for your organization and for individual SDK keys, and list the signals they apply to. ## API reference: Webhook events - [Event envelope](https://docs.fingerly.io/reference/webhooks/envelope.md): Every Fingerly webhook is an HTTPS POST with the same headers, the same signature scheme and the same versioned JSON envelope around its data. - [identification.completed](https://docs.fingerly.io/reference/webhooks/identification-completed.md): Sent for every identification that finishes, with the visitor, the confidence, the score and your tag. - [visitor.suspect](https://docs.fingerly.io/reference/webhooks/visitor-suspect.md): Sent when an identification reaches the high suspect level, with the score, your threshold and every signal behind it. - [identification.refused](https://docs.fingerly.io/reference/webhooks/identification-refused.md): Sent when an identify request is refused: an expired or revoked key, an origin that is not allowed, billing, rate limiting or no credit. - [billing.status_changed](https://docs.fingerly.io/reference/webhooks/billing-status-changed.md): Sent when your organization's billing status changes, including whether it is accepting traffic. Live endpoints only. - [usage.daily_settled](https://docs.fingerly.io/reference/webhooks/usage-daily-settled.md): Sent once a UTC day of usage is settled, with the day's checks and what they cost, for live and test traffic. ## API reference: SDK reference - [JavaScript agent](https://docs.fingerly.io/reference/javascript-agent.md): Every export, option, result field and error of the Fingerly browser SDK, @fingerly/web-js.