Device ID integrations

Ad blockers block scripts and calls to outside addresses they know. Served from your own domain, the Device ID script and its calls look like the rest of your site, so they reach every visitor, and FFraud still sees each visitor's real address. One small relay on your host does it.

#How the relay works

• /_d/s.js on your domain serves the Device ID script.
• /_d/v1/* forwards the script's calls to https://api.ffraud.com/v1/* with two headers: X-FF-Proxy-Secret, your secret key, which proves the relay is yours, and X-FF-Client-IP, the visitor's address.
• FFraud accepts the address only when the secret key belongs to the same account as the page's public key, so a forged header never moves an address.
• Your secret key stays in your host's secret store and travels only from your server to FFraud. Your site's cookies stay home: every relay below drops them.

#On your pages

<script src="/_d/s.js"></script>
<script>
  FFraudSDK.identify({ apiKey: "pk_your_public_key", baseUrl: "/_d" });
</script>

Your public key must list your site under its allowed origins (Dashboard, API keys). The verdict is read from your server with the secret key, as in the Device ID docs.

#Pick your host

// FFraud Device ID relay for Cloudflare Workers.
// Route: yourdomain.com/_d/*   Secret: FFRAUD_SECRET_KEY (your secret key, ff_live_...)
const SCRIPT = "https://ffraud.com/api/sdk.js";
const API = "https://api.ffraud.com";
const PREFIX = "/_d";

export default {
  async fetch(request, env) {
    const url = new URL(request.url);
    if (url.pathname === PREFIX + "/s.js") {
      return fetch(SCRIPT, { cf: { cacheTtl: 3600, cacheEverything: true } });
    }
    if (!url.pathname.startsWith(PREFIX + "/v1/")) {
      return new Response("Not found", { status: 404 });
    }
    const headers = new Headers(request.headers);
    headers.delete("cookie");
    headers.set("x-ff-proxy-secret", env.FFRAUD_SECRET_KEY);
    headers.set("x-ff-client-ip", request.headers.get("cf-connecting-ip") || "");
    return fetch(API + url.pathname.slice(PREFIX.length) + url.search, {
      method: request.method,
      headers,
      body: request.method === "GET" || request.method === "HEAD" ? undefined : await request.arrayBuffer(),
    });
  },
};

#Check that it works

1. Open your site in a browser with an ad blocker on.
2. In the dashboard, Device ID, Identification: the new visit shows the visitor's own address, not your server's.
3. An error 2090 (PROXY_SECRET_MISMATCH) means the secret key belongs to another account than the page's public key. An error 2091 (CLIENT_IP_MISSING) means the relay did not send the visitor's address.