Setup

Integration checklist

Start Free and register the domain you want to protect.
Copy the keys. The Public Key goes in the browser. Private credentials stay on the backend.
Install a browser SDK or the CDN snippet. Use a stable pseudonymous User HID on signed-in checks.
Allow required connections in your Content Security Policy.
Retrieve the result by Identification ID, or receive signed webhooks.
Protect the action. Verify domain, account association, freshness and reuse before acting.

The Quickstart walks through a complete browser-to-backend setup. Where to integrate helps choose the first action.

Plain JavaScript snippet

<script type="module">
  const mod = await import('https://cdn.shieldlabs.ai/snippet.js?publicKey=PUBLIC_API_KEY');
  mod.checkAnonymous();
</script>

Use checkAuthenticatedUser('PSEUDONYMOUS_USER_ID') on signed-in pages. Importing the module alone does not start a check. See snippet methods for initialization callbacks and cooldown behavior.

What you receive

The scored webhook includes the check’s identifiers, Risk Score, signal contributions, detection flags and available account-event evaluations. This is an abbreviated example:

{
  "event_id": "example-event-id",
  "event_type": "identification.scored",
  "schema_version": "2026-10-13",
  "created_at": "2026-10-13T10:00:00Z",
  "data": {
    "identification_id": "8f1d0c2a-7b3e-4a9c-9d2f-1e6a5b4c3d21",
    "user_hid": "a91f3c7e5b2d4086",
    "risk_score": 90,
    "signals": [
      { "name": "vpn", "weight": 30 },
      { "name": "antidetect_browser", "weight": 60 }
    ],
    "observed_at": "2026-10-13T10:00:00Z"
  }
}

Verify X-Shield-Signature over the original raw body. Persist and deduplicate by event_id before acknowledging; delivery can retry. The reference contains the full versioned model and the separately enabled multi-account group event. History uses its own response projection, including score rather than risk_score. Read it with the matching domain’s Private API Key. Processing is asynchronous, so handle pending and unavailable results explicitly.

Before production

Test a normal check, a signed-in check, a missing result, an invalid signature and duplicate delivery. Confirm the application does not accept a browser-supplied score or reuse an Identification ID to repeat a protected benefit. Keep staging credentials separate and monitor usage.

Getting started

Account and domains

Browser integration

Server integration

AI

Billing and usage

Troubleshooting

Help

Integration checklist

Plain JavaScript snippet

What you receive

Before production

​Integration checklist

​Plain JavaScript snippet

​What you receive

​Before production

Integration checklist

Plain JavaScript snippet

What you receive

Before production