Reference · SDK

Browser SDK

The script tag, every data-* attribute, the events and the window API.

One <script> tag. There is no npm package, the tag is the whole browser integration.

<script src="https://hideguard.io/sdk/v1.js"
        data-site-key="pk_live_..."
        data-block="true"></script>

Attributes#

Attribute	Default	Meaning
`data-site-key`	required	The site's public key
`data-endpoint`	the script's own origin	Where to post. Only needed when served from a CDN
`data-auto`	`true`	Collect on load. `false` leaves it to you
`data-block`	`false`	Show the built-in interstitial when the verdict is `block`
`data-cookie`	`true`	Set the `fpc_vid` cookie on your domain
`data-heartbeat`	`true`	Beat back so the dashboard can count open pages
`data-behavior`	`true`	Collect behaviour. Adds no request
`data-requests`	`false`	Opt-in. Record the requests your own code makes
`data-active-probes`	`false`	Enable the more expensive active measurements
`data-syn-check`	`true`	Ask for the visitor's own connection's SYN packet
`data-ip-check`	off	URL of a second host answering "which address do you see me as"
`data-ip-check-key`	the bundled key	The key for that host, when you run your own copy

Why `data-block` is off by default#

A script that can black out a customer's page the moment it is installed is a script nobody should install.

Why `data-requests` must be opted into#

It replaces your page's fetch and XMLHttpRequest.prototype.send. Adding a listener is something a script does to itself; wrapping a transport is something it does to your application.

It holds nothing and changes no return value. It calls the native transport with your own arguments and returns exactly what that returns.

The window API#

// Manual collection when data-auto="false"
const result = await window.FingerprintCollector.collect();

The event#

window.addEventListener("fpc:verdict", (event) => {
  const { verdict, score, visitorId, requestId } = event.detail;
});

This verdict is information, not a gate. It arrives after the page was served, and a client that runs no JavaScript never meets it. The half that can refuse is POST /api/v1/verdict.