FP FINGERPRINT

User verification guide

Use fingerprint.dev to add device familiarity to login, recovery, and high-risk account workflows. It should support your authentication system, not replace it.

  1. Call /identify after a successful login or trusted account action.
  2. Store visitor_id, confidence, account ID, and the trusted timestamp.
  3. Call /identify before recovery, payment-method changes, payout changes, or sensitive settings updates.
  4. Compare the current visitor against previously trusted visitors for that account.
  5. Step up when the visitor is unfamiliar or the confidence is below your threshold.

Enrollment

import { identify } from "fingerprint.dev";

let result = await identify({
  apiKey: "fp_live_...",
});

if (result.visitor_id !== null && result.confidence !== null) {
  await fetch("/account/trusted-visitors", {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify({
      visitor_id: result.visitor_id,
      confidence: result.confidence,
    }),
  });
}

Enroll only after the account action is already trusted. For example, after password auth plus MFA succeeds, or after an admin confirms a recovery request.

Step-up checks

let knownVisitor = await accountStore.findTrustedVisitor({
  accountId,
  visitorId: result.visitor_id,
});

if (knownVisitor === null) {
  return requireMfa();
}

if (result.confidence === null || result.confidence < 0.8) {
  return requireMfa();
}

return continueSensitiveAction();

Tune thresholds by workflow. A recovery flow can require a stronger match than a routine settings change.

What to show users

Do not expose raw fingerprint evidence. If you need to explain a step-up challenge, use normal account-security language such as "new browser or device" and keep the actual visitor_id internal.