> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shieldlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Integration
> Install the snippet, manage your domains, keys and webhook endpoints, and check that each site is reporting.
This page describes the new analytics dashboard, which is rolling out to all accounts.
Integration is where you connect a site to ShieldLabs. It has four tabs: **Install**, **Domains**, **API keys** and **Webhooks**. Pick the domain you are working on at the top of the screen; the period there sets the identification counts and key usage shown on this screen. Each section below maps one tab and links the setup page with the full steps.
## Install
**Install** shows the snippet for the selected domain, with its Public Key already in the import URL.
* **Pick your stack** to get the snippet in the form your platform expects.
* **Anonymous visitors**: the snippet with `checkAnonymous()`, for pages without sign-in.
* **Authenticated users**: the snippet with `checkAuthenticatedUser(userHashedId)`. Pass a hashed User HID with `checkAuthenticatedUser` on every signed-in page. Users, account-level risk and all four High-Risk Events are built on it. Use a hashed or pseudonymous ID, never a raw internal ID.
* **Snippet methods**: `checkAnonymous`, `checkAuthenticatedUser`, `forceCheckAnonymous` and `forceCheckAuthenticatedUser`.
`checkAnonymous` and `checkAuthenticatedUser` run at most one identification every five minutes for the same user in the same browser, shared across open tabs. A call inside that window posts nothing, counts nothing, and its `onInitialized` handler receives `{ status: "not_initialized" }`. `forceCheckAnonymous` and `forceCheckAuthenticatedUser` run an identification every time, keep the current Session ID and restart the five-minute window.
The banner under the snippets shows whether the domain is reporting: it says identifications are arriving, with the time of the last one, once they do; **Pending**, with **Recheck**, until the first one arrives; **Paused**, with **Open Domains**, while you have paused the domain; and **Frozen** while the domain is at its rate limit. If your site sends a Content-Security-Policy header, allow the hosts listed on [Content Security Policy](/setup/csp). Full steps: [Install the snippet](/setup/snippet).
**Install with AI**, marked **Alternative**, gives the same install as a ready-made instruction for your AI assistant: your domain and Public Key, the snippets for anonymous visitors and signed-in users, the Content-Security-Policy header, where the snippet goes and how to check the install. Copy it with the copy button on the card or with **Copy installation guide** at the top of the tab; **Show the whole prompt** expands it. [Build with AI](/build-with-ai) has prompts for the rest of the integration.
## Domains
**Domains** lists every domain on your account with its **Status**, its identifications in the period and its **Subdomains** setting.
| Status | What it means |
| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Reporting** | Identifications are arriving from the domain. |
| **Pending** | Added, and no identification has arrived yet. The domain verifies itself on its first call. |
| **Paused** | You paused it, so its calls are not identified until you resume it. Nothing is deleted. |
| **Frozen** | The domain is at its request-rate limit, so its calls get HTTP 429 and are not billed. It resumes on its own once traffic eases. See [Rate limits](/rate-limits). |
**Subdomains** reads **Accepted** when the domain also takes traffic from its subdomains, and **Exact host** when it takes only its own host. Each domain can be paused, resumed or deleted; deleting asks you to type the domain back and keeps its identification history. **Add domain** adds a host; at your plan's limit the button reads **Upgrade plan to add a domain**. Your plan sets how many domains you can add: Free 1, Starter 1, Growth 3, Scale 5. All your domains share one account quota. Full steps: [Domains](/setup/domains).
## API keys
**API keys** shows one key type at a time: pick **Public Key**, **Private API Key** or **Secret Key**, and each domain in scope gets a row with its key, when it was last used and its usage in the period.
| Key | Where it goes |
| ------------------- | ------------------------------------------------------------------------------------- |
| **Public Key** | The snippet URL in the browser. |
| **Private API Key** | Your server, to read identifications from the History API on `account.shieldlabs.ai`. |
| **Secret Key** | Your server, for the Management API on `api.shieldlabs.ai`. |
The Public Key shows in full and the other two are masked. The copy button copies the full key. **Rotate** replaces it, and the previous key stops working at once, so update your snippet or server client first. Full steps: [API keys](/setup/keys).
## Webhooks
**Webhooks** lists your endpoints with their signing secret, status and last delivery. **Add endpoint** registers an HTTPS URL for a domain. Each domain takes up to 10 endpoints, and each endpoint gets its own `whsec_` signing secret.
* **Verify** sends a `webhook.ping` delivery. A 2xx answer verifies the endpoint.
* **Test** sends a sample `identification.scored` delivery and shows the HTTP status and how long it took.
* **Edit**, **Rotate secret**, pause or resume deliveries, and **Delete** manage the endpoint.
An endpoint moves through the statuses Pending, Waiting for the first event, Delivering, Failing, Verification failed and Paused.
**Verify a signature** shows how to check the `X-Shield-Signature` header, `sha256=` followed by the HMAC-SHA256 of the raw request body, in Node.js, Python, Go, PHP, Ruby and C#. Full steps: [Webhooks](/setup/webhooks).
## Next steps
Both snippets, the four methods and framework examples.
The User HID that users and High-Risk Events are built on.
Add, pause and scope your domains.
What each key authenticates and where it belongs.
Register an endpoint and verify every delivery.
Every identification of one account through the History API.