Skip to main content
Terms for installing ShieldLabs and reading results on your server. Entities, identification fields and risk signals stay in the glossary. The snippet install guide and the API overview cover the same concepts in full.

​
Browser integration

​
Snippet

The ShieldLabs JavaScript snippet: an ES module loaded from cdn.shieldlabs.ai that collects signals in the browser and runs an identification when you call checkAnonymous, checkAuthenticatedUser or a forceCheck* variant.

​
SDK

A software development kit for integrating ShieldLabs. Browser SDKs start identifications and return their Identification IDs. Server SDKs read results and provide helpers for processing them. See SDKs.

​
Cooldown

The same-user visit window that suppresses repeat regular snippet checks. A suppressed call creates no identification and consumes no identification quota. See Visit and cooldown behavior.

​
Force check

An explicit identification that bypasses the regular-check cooldown. It creates a fresh Identification ID, consumes one identification when admitted and restarts the cooldown. It does not create a new Session ID. See Snippet methods.

​
Server results

​
Server API

The server-side APIs: the History API on account.shieldlabs.ai (Private API Key), which reads your identifications, and the Management API on api.shieldlabs.ai (Secret Key), which reads your profile and the remaining included volume on your account.

​
Snapshot

A stored identification. History returns identifiers, score, supported is_* flags and attribution fields.

​
API keys

​
Public Key

The per-domain key placed in the snippet URL. It identifies the domain and is safe to expose in the browser.

​
Private API Key

The per-domain sec_… key used on your backend to authenticate the History API on account.shieldlabs.ai. Sent as a Bearer token; never expose it in the browser.

​
Secret Key

The per-domain key used only on your backend to authenticate the Management API. Never ship it to the browser. Webhooks use separate whsec_… signing secrets per endpoint.

​
Webhooks

​
Webhook

A signed server-to-server event. identification.scored describes a check; separately enabled hre.multi_account.changed describes a group lifecycle change. Delivery has bounded retries. See Webhooks.

​
Webhook signing secret

The whsec_… value for one webhook endpoint. It keys the HMAC in the X-Shield-Signature header. Copy it from your endpoint in the analytics dashboard under Integration > Webhooks; one secret per endpoint.

​
Event ID

The event_id of a webhook event. Retries preserve it, so it identifies repeated deliveries of the same event. An Identification ID identifies a browser check; an Event ID identifies its notification or a separate group-change event. See Webhook envelope.

​
Schema version

The schema_version of a webhook body. Read it together with event_type to select the matching event model. It is separate from the installed SDK package version. See Versions and availability.

​
X-Shield-Signature

The request header that carries the webhook HMAC: sha256= plus hex(HMAC-SHA256(key = the endpoint’s whsec_… secret, message = the raw body)). Verify it before trusting the payload.

​
Idempotency

Processing a repeated input without repeating its effect. Deduplicate webhook delivery by event_id; atomically bind accepted identifications to protected business actions. Group state also requires revision ordering.

​
AI tools

​
MCP

Model Context Protocol: the interface an AI client uses to discover and call ShieldLabs tools. Use it to investigate identifications and, when exposed by the connection, manage domains and webhooks. See Connect an AI client.

​
OAuth

The sign-in and authorization flow used by the ShieldLabs MCP connection. You sign in to ShieldLabs and authorize the client; the client manages access tokens.

​
Usage

​
Included volume

The number of identifications your plan includes: 5,000 one time on Free, and a set volume per billing cycle on paid plans, shared by all your domains. History reads, webhooks, the analytics dashboard, exports and profile reads are free. At the included volume the identification request returns HTTP 402 until the billing cycle resets or you change plan; on Free, until you change plan. See Billing.