Device identification for browsers and apps

Browser identification

A small agent script reads the browser signals and returns one opaque attestation. Your backend passes it to the API, and the server hashes, fuzzy-matches and scores the signals. Routine browser changes such as an update do not create a new visitor.

The agent is served from your own domain, so content blockers do not treat it as a third-party tracker and the first-party ID works on your origin.

Native device identification

The open-source Android, iOS and macOS SDKs identify an app install from hardware-backed and platform identifiers where the operating system provides them, and add a platform proof that the request comes from your genuine app. A command-line client is available for tools and tests.

See the SDKs and install lines →

Several browsers, one visitor

People who are refused in one browser try another. Browsers used on the same computer and network resolve to the same visitor, so a claim made in one is seen from the others.

One household, one claim

Limits count the household, not only the browser: devices seen on the same home network count together, and your website and your apps can share one limit through a claim group. A device that claimed before anything tied it to a household is flagged later, and your backend lists the flags and decides. Nothing is revoked automatically.

How this stops multi-accounting →

What stays on the server

• The client receives one opaque attestation. There is no visitor ID or score in the page or the app.
• The visitor ID and the decision come back only to your backend, using your secret key.
• An attestation is single-use and short-lived, so a captured one cannot be replayed.

Limits worth knowing

A phone that only ever uses mobile data on its own carrier cannot be tied to a household by its fingerprint. The email and network checks still apply to it, and it is flagged as soon as it joins the household network. Identification is a strong signal for abuse prevention, not proof of who a person is.

Identify a browser

Your backend creates an intent, the page identifies the browser and sends the attestation to your backend unchanged. The full flow is in the developer guide.

const { intentToken } = await (await fetch('/api/fpchecker/intent', { method: 'POST' })).json();
const { attestation } = await window.FpGuardAgent.identifyV2({
  baseUrl: 'https://api.fpchecker.com',
  publishableKey: 'pk_...',
  intentToken,
});
return attestation; // opaque: send it to your backend unchanged

Frequently asked questions