Open source: the client SDKs are open, the service is hosted
The code that runs in your page or app is open source, so you can read exactly what is collected and sent. The server that matches devices, scores requests and makes decisions is a hosted service and is not open source.
Open source
- The browser agent and the Android, iOS and macOS SDKs, plus command-line examples, under Apache-2.0.
- The identify protocol specification, so you can see how a request is built.
Hosted, not open source
Keeping this side closed is deliberate. Publishing how a score is computed would tell an attacker what to change.
- Device matching, scoring and decision logic.
- The API server and the console.
Why a clear split matters
An open-source client library alone can be forged by anyone who controls the browser. The server side is what makes the result trustworthy, which is why the SDKs only collect signals and never decide.
Contributing
Issues and pull requests for the SDKs are welcome in the repository. Protocol details are in the published specification.
Frequently asked questions
Can I self-host the service?
No. The service is hosted by us.
What license do the SDKs use?
Apache-2.0.
Try it on your own sign-up flow
Every new account gets 2,000 free checks. No card required.