> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shieldlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Integration glossary

> SDKs, MCP, OAuth, API keys, webhooks and terms for integrating ShieldLabs.

Terms for installing ShieldLabs and reading results on your server. Entities, identification fields and risk signals stay in the [glossary](https://docs.shieldlabs.ai/glossary.md).

The [snippet install guide](https://docs.shieldlabs.ai/setup/snippet.md) and the [API overview](https://docs.shieldlabs.ai/api/overview.md) cover the same concepts in full.

## Browser integration

### Snippet

The ShieldLabs JavaScript snippet: an ES module loaded from `cdn.shieldlabs.ai` that collects signals in the browser and runs an identification when you call `checkAnonymous`, `checkAuthenticatedUser` or a `forceCheck*` variant.

### SDK

A software development kit for integrating ShieldLabs. Browser SDKs start identifications and return their Identification IDs. Server SDKs read results and provide helpers for processing them. See [SDKs](https://docs.shieldlabs.ai/api/sdks.md).

### Cooldown

The same-user visit window that suppresses repeat regular snippet checks. A suppressed call creates no identification and consumes no identification quota. See [Visit and cooldown behavior](https://docs.shieldlabs.ai/setup/optimizing-usage.md).

### Force check

An explicit identification that bypasses the regular-check cooldown. It creates a fresh Identification ID, consumes one identification when admitted and restarts the cooldown. It does not create a new Session ID. See [Snippet methods](https://docs.shieldlabs.ai/setup/snippet.md#the-four-exports).

## Server results

### Server API

The [server-side APIs](https://docs.shieldlabs.ai/api/server-api.md): the **History API** on `account.shieldlabs.ai` (Private API Key), which reads your identifications, and the **Management API** on `api.shieldlabs.ai` (Secret Key), which reads your profile and the remaining included volume on your account.

### Snapshot

A stored identification. History returns identifiers, `score`, supported `is_*` flags and attribution fields.

## API keys

### Public Key

The per-domain key placed in the snippet URL. It identifies the domain and is safe to expose in the browser.

### Private API Key

The per-domain `sec_…` key used on your backend to authenticate the [History API](https://docs.shieldlabs.ai/api/server-api.md) on `account.shieldlabs.ai`. Sent as a Bearer token; never expose it in the browser.

### Secret Key

The per-domain key used only on your backend to authenticate the Management API. Never ship it to the browser. Webhooks use separate `whsec_…` signing secrets per endpoint.

## Webhooks

### Webhook

A signed server-to-server event. `identification.scored` describes a check; separately enabled `hre.multi_account.changed` describes a group lifecycle change. Delivery has bounded retries. See [Webhooks](https://docs.shieldlabs.ai/api/webhooks.md).

### Webhook signing secret

The `whsec_…` value for one webhook endpoint. It keys the HMAC in the `X-Shield-Signature` header. Copy it from your endpoint in the analytics dashboard under **Integration > Webhooks**; one secret per endpoint.

### Event ID

The `event_id` of a webhook event. Retries preserve it, so it identifies repeated deliveries of the same event. An Identification ID identifies a browser check; an Event ID identifies its notification or a separate group-change event. See [Webhook envelope](https://docs.shieldlabs.ai/api/webhooks.md#envelope).

### Schema version

The `schema_version` of a webhook body. Read it together with `event_type` to select the matching event model. It is separate from the installed SDK package version. See [Versions and availability](https://docs.shieldlabs.ai/api/versions.md).

### X-Shield-Signature

The request header that carries the webhook HMAC: `sha256=` plus hex(HMAC-SHA256(key = the endpoint's `whsec_…` secret, message = the raw body)). Verify it before trusting the payload.

### Idempotency

Processing a repeated input without repeating its effect. Deduplicate webhook delivery by `event_id`; atomically bind accepted identifications to protected business actions. Group state also requires revision ordering.

## AI tools

### MCP

Model Context Protocol: the interface an AI client uses to discover and call ShieldLabs tools. Use it to investigate identifications and, when exposed by the connection, manage domains and webhooks. See [Connect an AI client](https://docs.shieldlabs.ai/setup/mcp.md).

### OAuth

The sign-in and authorization flow used by the ShieldLabs MCP connection. You sign in to ShieldLabs and authorize the client; the client manages access tokens.

## Usage

### Included volume

The number of identifications your plan includes: 5,000 one time on Free, and a set volume per billing cycle on paid plans, shared by all your domains. History reads, webhooks, the analytics dashboard, exports and profile reads are free. At the included volume the identification request returns HTTP 402 until the billing cycle resets or you change plan; on Free, until you change plan. See [Billing](https://docs.shieldlabs.ai/billing.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.