Integration

Integration is where you connect a site to ShieldLabs. It has four tabs: Install, Domains, API keys and Webhooks. Pick the domain you are working on at the top of the screen; the period there sets the identification counts and key usage shown on this screen. Each section below maps one tab and links the setup page with the full steps.

​

Install

Install shows the snippet for the selected domain, with its Public Key already in the import URL.

• Pick your stack to get the snippet in the form your platform expects.
• Anonymous visitors: the snippet with checkAnonymous(), for pages without sign-in.
• Authenticated users: the snippet with checkAuthenticatedUser(userHashedId). Pass a hashed User HID with checkAuthenticatedUser on every signed-in page. Users, account-level risk and all four High-Risk Events are built on it. Use a hashed or pseudonymous ID, never a raw internal ID.
• Snippet methods: checkAnonymous, checkAuthenticatedUser, forceCheckAnonymous and forceCheckAuthenticatedUser.

checkAnonymous and checkAuthenticatedUser run at most one identification every five minutes for the same user in the same browser, within the same visit and shared across open tabs. A full page load in the only open tab can start a new visit; see visit and cooldown behavior. A call inside that window posts nothing, counts nothing, and its onInitialized handler receives { status: "not_initialized" }. forceCheckAnonymous and forceCheckAuthenticatedUser run an identification every time, keep the current Session ID and restart the five-minute window. The banner under the snippets shows the selected domain’s reporting state and the time of its last saved check. Reporting means at least one check has been saved; it does not guarantee recent activity. Pending means no check has been saved yet. Paused and Frozen indicate the restrictions described below. If data cannot be loaded, Unavailable must not be interpreted as Pending. If your site sends a Content-Security-Policy header, allow the hosts listed on Content Security Policy. Full steps: Install the snippet. Install with AI, marked Alternative, gives the same install as a ready-made instruction for your AI assistant: your domain and Public Key, the snippets for anonymous visitors and signed-in users, the Content-Security-Policy header, where the snippet goes and how to check the install. Copy it with the copy button on the card or with Copy installation guide at the top of the tab; Show the whole prompt expands it. Build with AI has prompts for the rest of the integration.

​

Domains

Domains lists every domain on your account with its Status, its identifications in the period and its Subdomains setting. One status is shown. Paused takes priority if the domain is both paused and at its rate limit. See Domain status. Subdomains reads Accepted when the domain also takes traffic from its subdomains, and Exact host when it takes only its own host. Each domain can be paused, resumed or deleted; deleting asks you to type the domain back and keeps its identification history. Add domain adds a host; at your plan’s limit the button reads Upgrade plan to add a domain. Your plan sets how many domains you can add: Free 1, Starter 1, Growth 3, Scale 5. All your domains share one account quota. Full steps: Domains.

​

API keys

API keys shows one key type at a time: pick Public Key, Private API Key or Secret Key, and each domain in scope gets a row with its key, when it was last used and its usage in the period. The Public Key shows in full and the other two are masked. The copy button copies the full key. Rotate replaces it, and the previous key stops working at once, so coordinate rotation with updating the snippet or server client. Full steps: API keys.

​

Webhooks

Webhooks lists your endpoints with their signing secret, status and last delivery. Add endpoint registers an HTTPS URL for a domain. Each domain takes up to 10 endpoints, and each endpoint gets its own whsec_ signing secret.

• Verify sends a webhook.ping delivery. A 2xx answer verifies the endpoint.
• Test sends a sample identification.scored delivery and shows the HTTP status and how long it took.
• Edit, Rotate secret, pause or resume deliveries, and Delete manage the endpoint.

An endpoint moves through the statuses Pending, Waiting for the first event, Delivering, Failing, Verification failed and Paused. Verify a signature shows how to check the X-Shield-Signature header, sha256= followed by the HMAC-SHA256 of the raw request body, in Node.js, Python, Go, PHP, Ruby and C#. Full steps: Webhooks.

​

Next steps