Domain Setup
Each domain in ShieldLabs is an independent protection unit with its own keys, webhook, and analytics.
Adding a domain
- Go to dashboard.shieldlabs.ai → Domains → Add domain
- Enter your domain name (e.g.
example.com)
- Copy the Public Key and Secret Key
- Set the webhook URL in Domains → Webhook (or via API after creation)
Creating a domain accepts only the domain name — the webhook URL is configured separately:
POST /api/domains
{ "domain": "example.com" }
Domain fields
| Field | Description |
|---|
domain | Your domain name |
public_key | 32-character hex string used in the JS snippet |
secret_key | 32-character hex string for webhook HMAC and Pub API |
callback | Webhook URL (set via Dashboard or PUT /api/domains/{id}/webhook) |
enabled | Whether the domain is actively processing traffic |
domain_verified | Whether live snippet traffic has been detected |
Updating a domain
Enable or disable protection:
curl -X PATCH "https://account.shieldlabs.ai/api/domains/{domain_id}" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "Content-Type: application/json" \
-d '{"enabled": true}'
curl -X PUT "https://account.shieldlabs.ai/api/domains/{domain_id}/webhook" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "Content-Type: application/json" \
-d '{"callback": "https://new-server.com/webhook"}'
Domain verification
Verification is automatic — no DNS records required.
- Add the snippet to your site with the domain’s public key
- When a browser sends the first fingerprint, Shield.Core records traffic for your domain
- Within ~30 seconds,
domain_verified becomes true in the dashboard
Unverified domains that receive no traffic for 7 days are automatically removed.
Traffic weight
If you have multiple domains, the dashboard shows each domain’s share of your total request quota (requests_percent). Weight is stored in Redis and decremented per fingerprint check.
Deleting a domain
curl -X DELETE "https://account.shieldlabs.ai/api/domains/{domain_id}" \
-H "Authorization: Bearer YOUR_JWT_TOKEN"
Deleting a domain removes the domain configuration from the dashboard and Redis. Historical snapshots in ClickHouse may be retained — contact support for data deletion requests.
