Skip to main content
An identification starts in the browser and finishes on ShieldLabs servers. The browser receives a Identification ID. Your backend receives the result by webhook or reads it through the History API.

​
The three steps

  1. Collect. The JavaScript SDK or snippet starts a check and receives an Identification ID, not a Risk Score.
  2. Evaluate. ShieldLabs finishes applicable checks, calculates the score and, for a tracked user, calculates Account sharing, Account takeover and Impossible travel.
  3. Deliver. ShieldLabs sends a signed identification.scored event or makes the result available through History. Use data.identification_id to join it to the original browser check.

​
Browser acknowledgment

Use the Identification ID returned by your browser integration to correlate a check. The callback does not contain a trusted risk verdict and does not prove that the server result is already available. Pass a consistent pseudonymous User HID for signed-in users. Anonymous checks still identify the visitor and device, but do not establish account-level history. See snippet methods.

​
Finalization and timing

The result may not be available immediately after the browser returns an Identification ID. Use a bounded wait or a webhook, and handle missing and unavailable results separately from a low-risk result. See High-Risk Event statuses.

​
Webhook and History

  • Webhook: signed result pushed to your endpoint. Delivery can repeat; deduplicate by event_id.
  • History: stored identifications queried by Identification ID or another supported identifier. An immediate read can be empty while processing is pending; use bounded retries.
Bind the Identification ID to the authenticated action in your backend. Validate the returned domain and User HID before applying a decision. Do not let a browser reuse another user’s result.

​
Multi-accounting has a separate event

Multi-accounting has a separate hre.multi_account.changed event with a cluster ID and member list, not a check’s Identification ID. Enable it separately from scored-identification delivery. See multi-account events.

​
Next steps