Frequently asked questions
Short answers to the questions we hear most. Details are in the developer guide and on the pricing and security pages.
Frequently asked questions
What does FingerPrint Checker answer?
May this user claim a free trial, coupon or sign-up bonus (one per device, per email and per household)? May this anonymous visitor use this feature again? Is this invitee really someone new? Each decision is allow, a human check or deny.
How do I integrate it?
Your backend creates an intent, the web agent or the SDK identifies the device and returns an opaque attestation, and your backend sends it to the decision endpoint with your secret key.
What happens when a decision asks for a human check?
By default the client solves a short proof-of-work in the background. You can choose Cloudflare Turnstile instead. Then you ask again.
What data do you store?
The device signals needed to recognise a device on its next visit. Native hardware identifiers and your user IDs are stored only as keyed hashes. Device records are deleted after 180 days without a visit, events after the 7 to 90 days you set per project, denial records after 90 days and quota usage after 8 days.
How does pricing work?
Every new account gets 2,000 free checks. After that you buy prepaid packs. Credits last 12 months.
What counts as a check?
Each decision uses one credit. Identifying a device, creating an intent, reading events, bot checks, sending feedback and every error response are free.
Does it detect VPNs?
Yes. Every event carries a VPN signal with the reasons it was raised, plus separate proxy, datacenter and Tor fields. Your backend reads them with your secret key. A VPN alone is not a reason to deny, because many honest visitors use one; most teams send those visits to a human check or review.
Can I read what happened later, and get notified?
Yes. Every identify is stored as an event that you read and search with your secret key, tag with your own ids, and receive as a signed webhook. Browsers and apps only see the event id. Reading and searching events is free.
Does it detect bots?
Yes. Each event says good bot, bad bot or not detected, names the bots we recognise with their operator, and flags AI agents and impersonators. Your backend can also send a plain HTTP request to the bot check API and get the result without the browser script. Bot checks are free.
What do the mobile signals do?
Apps built with the mobile SDKs report root or jailbreak, hooking, emulator, debugger, developer mode, traffic interception, device VPN, location spoofing and cloned app, each true, false or unknown. They are recorded and returned to your backend but not scored yet: they do not change the trust score, and act only through rules you write.
Can my team share an account?
Yes. Invite teammates with owner, admin, billing, editor or viewer roles. Changes to projects, keys, webhooks, rules and members go into an audit log, and each project can have test and production environments with their own keys.
Is there a command line or an AI integration?
Yes. Run npx -y @fingerprintchecker/cli for the fpchecker command line and a local MCP server for Claude Desktop, Cursor and Claude Code. It is read-only unless you turn writes on.
What is free?
Identifying devices, reading and searching events, bot checks, feedback labels and every error response are free. Only decisions use credits.
Can it be wrong?
Yes. A shared network such as an office or a café can look like one household, and a person on mobile data alone cannot be tied to a household by fingerprint. Use review paths for cases that matter and send feedback labels.
Is it open source?
The client SDKs and the protocol are open source under Apache-2.0. The server is a hosted service.
Is the service certified?
We hold no SOC 2, ISO 27001 or HIPAA certification and do not claim any.
Do you have a newsletter or a sales call?
No newsletter. If you want to talk, use the contact form.
Try it on your own sign-up flow
Every new account gets 2,000 free checks. No card required.