Skip to main content
ShieldLabs is a snippet, a webhook, and a read API. The browser snippet collects 100+ browser, device, and network signals and posts them to ShieldLabs automatically. The server derives a persistent identity and an explainable Risk Score (0-100), then delivers it to your backend by webhook (and you can read it back any time from the Server API). Your own code reads the score plus its signals and decides allow, challenge, review, or block. ShieldLabs scores; you decide. Most teams get their first Risk Score in about 5 minutes.

​
Integration checklist

1

Create a domain and get your keys

Sign up for free and get 5,000 identifications, or log in if you already have an account, then register the domain you want to identify visitors on. ShieldLabs issues a Public Key (per domain, safe to put in the browser) plus server-side credentials — a Private API Key for the History API and a Secret Key for the Management API. Each webhook endpoint you add in the dashboard gets its own whsec_… signing secret. The Keys and Domains pages cover them.
2

Install the snippet

Load the ES module from cdn.shieldlabs.ai with your Public Key and call checkAnonymous(). It is a dynamic import(), not an npm package and not a native SDK, web only. The Snippet page has framework examples for Native JS, React, Angular, Vue, Preact, and Svelte.
3

Allow the hosts in your CSP

If you run a Content Security Policy, allow the ShieldLabs CDN and the endpoints the snippet posts to per the CSP directives. Without this the snippet is blocked and you receive no signals.
4

Register a webhook

Point ShieldLabs at one or more backend URLs so scores are pushed as they are computed. Add endpoints in the dashboard Webhooks tab (up to 10 per domain). Each endpoint has its own whsec_… signing secret; verify the X-Shield-Signature header on the raw request body as the Webhooks guide details.
5

Verify the score, then act on it

Trigger an identify call (load a page with the snippet), confirm your webhook receives the scored event in about a second, and verify the signature. Read score and signals, then your code decides what to do. There is no in-product rules engine: the decision lives in your application, where acting on the Risk Score walks the allow, challenge, review, or block paths.
Want the fastest path end to end? The Quickstart walks the same five steps with copy-paste snippets and a working webhook handler.

​
Setup pages

Snippet

Install the ES-module snippet, the checkAnonymous and checkAuthenticatedUser exports, framework examples, and what gets collected.

Keys

Public Key vs Secret Key: where each one goes, what it authenticates, and how to keep the secret out of the browser.

Webhooks

Register endpoints in the dashboard, verify X-Shield-Signature, and handle the flat scored payload.

CSP

The exact script-src and connect-src directives the snippet needs.

Domains

Register a domain, how the snippet ties traffic to it, and managing multiple domains under one account.

Environments

Separate staging and production with distinct domains and keys so test traffic never mixes with live data.

​
What you receive

Once the snippet is live and your webhook is registered, every identify call produces an event like this. The signals array names each signal that fired and the points it contributed, so the score is explainable, not a black box.
The Score runs 0 to 100, capped at 100, and sorts into four bands (Clean, Low, Medium, High) that the Risk Score page defines in full. The bands are a guide; the action per band is yours to write in your own code.
A legitimate visitor can score high (a corporate proxy, a VPN, or a privacy browser). Decide on the Score plus the signals plus your action context, never the number alone, and the playbook for acting on the Risk Score shows how to tune your thresholds gradually.
Webhooks are at-most-once with no retries and a roughly 1-second timeout. Make your handler idempotent on request_id, and for guaranteed reads poll the History API rather than relying on the webhook alone.

​
Where to go next

With the snippet installed and a webhook verified, read the Overview to understand the identifiers and the Risk Score, then jump into the Cookbook for worked examples like login and 2FA, checkout, and affiliate fraud. The API overview has the full payloads and endpoints.