Not every visitor is who they appear to be.

Device fingerprinting recognises a returning browser or device from what it reports about itself, instead of from a cookie it stores. A cookie lives in the browser, so clearing it or opening a private window starts over. Fingerly’s browser SDK writes no cookies and nothing to local storage, and the visitor ID is issued and remembered on Fingerly’s side.

Yes. Native iOS and Android SDKs, with React Native, Flutter and Lynx bridges, send the same identify request as the web SDK and get the same response. In an app the device is recognised by a random ID the SDK keeps, never by its hardware, and the native SDKs add checks for emulators, rooted and jailbroken devices.

Yes. Every identification classifies the address as a commercial VPN, a datacenter or residential proxy, a Tor exit node or a hosting network, and flags a mismatch with the device’s own region. Each one is a signal with a weight you set, because a VPN alone is context, not a verdict.

An identification is a request to evaluate a browser or device session and return its identifier and available signals. It is a usage event, not a monthly active user or a dashboard seat. Repeated identification calls count separately. Define which moments need a check, such as signup, login, or checkout, rather than identifying on every page render.

No. Every new account starts with $1 of credit, enough for 400 identifications, and no card is needed to spend it. Add funds from $5 when you are ready. Development and staging keys are never charged, so building and testing costs nothing.

No. Privacy tools have legitimate uses. Treat these signals as context alongside account behavior, device history, and transaction risk. A single signal should not automatically result in a blocked customer. In the demo, the VPN check says so: on its own, a tunnelled connection is context, not a verdict.

Yes. The session inspector opens empty, and its identify button runs a real identification of the browser you are reading this in: the same SDK, the same checks, the same score. Nothing is collected until you press it, nothing about the answer is stored on our side, and the visitor ID it shows is genuinely yours, which is why pressing it twice says returning visitor. Your address is placed and checked for a VPN, proxy or Tor the same way a customer’s visitor would be, in our own IP database, and the inspector shows the network and a map of where it was placed. The map tiles come from an open map service. A few checks need to know what a device has done across many requests, and the demo keeps no such history, so it marks those as not answered rather than showing you a clear result nobody computed.

Identify with the client SDK at a moment that matters, send the request ID to your backend, and read the stored result there with a secret key before you decide. The quickstart walks through it in six steps.

Set your collection scope, retention period, access policies, and visitor notices before going live. Requirements depend on your use case and jurisdiction. The privacy section describes design considerations, not a legal assessment or a certification. Have your privacy and legal teams review the production implementation.

Only the total. An identification starts at $0.0025 and falls as the month grows: $0.002 past 250,000 and $0.0015 past a million, with each band pricing the requests inside it. There is no plan to move up to and nothing to negotiate, and the discount applies itself. Billing is prepaid: turn on auto top-up and the balance refills before it runs out. Requests that cannot be identified are free, and retries of the same request are not charged twice.

Fingerly is a device fingerprinting and fraud detection API, also called device intelligence. It gives each visit a visitor ID for the device behind it, detects bots, VPNs, proxies, Tor, device farms, emulators and tampering, and adds the findings into a suspect score under weights you control. Your application decides what to do with it.

Yes. Fingerly is a device fingerprinting API with SDKs for the web, iOS, Android and your server. One identify call returns a visitor ID, the signals that fired and a suspect score, and your backend reads the stored result with a secret key before it decides.

Device intelligence is the context around a session: which device it is, what network it comes from and whether it shows signs of automation or tampering. Fingerly returns that context as a visitor ID, signals and a suspect score, so a signup, login or payment is judged on more than an email address or an IP.

Yes. Fingerly is pay as you go: a prepaid balance, no plans and no monthly fee, from $0.0025 per identification with volume discounts. Requests that cannot be identified are free, and the pricing page has a calculator for your own month.

Yes. Development and staging keys are always free and run the same detection as production, and every new account starts with $1 of free credit, enough for 400 production identifications, with no card needed.

Identify at signup, store the visitor ID beside every new account and read the result on your server. One device creating many accounts shows up as one visitor ID on all of them, and device farm, emulator and private-browsing signals make the cluster more telling. Review clusters, because a shared household is not fraud by itself.

Yes, as evidence for your own review. Check the session when a coupon, bonus or referral reward is claimed and connect the claims to the visitor IDs behind them. Repeat claims from one device, or from a device farm, stand out. Your policy decides whether to allow, review or refuse.

Yes. Fingerly reports driven and headless browsers, declared scrapers, virtual machines and unusually high activity without asking the visitor for anything, so no CAPTCHA or puzzle is needed. Your application decides how to respond, and it can still add a challenge for the sessions that need one.

Fingerly gives you the evidence at login. Identify at login, read the result on your server, recognise the devices an account normally uses, and add a second factor when a login is new and also automated or arriving from Tor. Bot detection flags the automated browsers behind credential stuffing.

It depends on how you use it, and Fingerly claims no certification and gives no legal assurance. Privacy law can treat device identifiers as personal data, so settle your lawful basis and visitor notice first. The SDKs collect nothing until you tell them consent is granted. Have your legal team review your implementation.