API reference

Device ID

Give every device on your site a stable ID and a risk score: one script on the page, one call from your server, with a public key and a secret key.

Device ID recognizes a device across visits, new accounts and cleared cookies. A script on your page collects the signals, our engine gives the device its ID and a score, and your server reads the result.

#Two keys

A public key (pk_...) goes in your page. It works only from the sites you list, and only for the device calls.
A secret key (ff_live_...) stays on your server. It reads the verdict.

Create both on the API keys page. List each site exactly as a browser writes it, such as https://shop.example.

#On your page

HTML

<script src="https://ffraud.com/api/sdk.js"></script>
<script>
  FFraudSDK.identify({ apiKey: "pk_your_public_key" }).then((device) => {
    // Send device.request_id to your server with the login, sign-up or order.
  });
</script>

Load it on the pages that matter: login, sign-up and checkout. The ID is ready in under a second on a desktop, and the rest of the signals follow within 2.5 seconds without blocking the page.

Never decide anything in the browser. A page can show any result it likes, so the browser gets the event ID and your server reads the verdict.

#On your server

GET/v1/events/{id}keyOne event's verdict. Only the account that made the event can read it.

curl https://api.ffraud.com/v1/events/REQUEST_ID \
  -H "X-API-Key: ff_live_your_secret_key"

Field	Meaning
visitor_id	The device. The same device keeps it across visits, and two accounts with one `visitor_id` used one device.
suspect_score	0 to 100. Higher means more signs of automation, spoofing or tampering.
signals.bot	Whether the visit looks automated.
signals.tampering	Whether the browser hides or fakes what it is, anti-detect browsers included.
signals.incognito	A private window.
signals.virtual_machine	A virtual machine.
signals.privacy_browser	A browser built to resist fingerprinting.

#List your devices

GET/v1/eventskeyYour latest events, newest first. `limit` goes up to 200, the default is 50.

#Your visitors

You decide what happens on your site, so you are responsible for telling your visitors and for any consent the law requires where they live. We keep each event for 90 days and show it only to your account.

PreviousDomain reputation NextCommunity reporting