Skip to main content
A domain is the unit of integration in ShieldLabs. You add each site you want to identify visitors on as its own domain, and that domain gets its own key set, its own webhook endpoints (up to 10), and its own request totals. Nothing is shared across domains: a key set issued for one domain does not work on another. If you run a single site, you have one domain. If you run several sites (or staging and production), each is a separate domain with its own configuration.

​
Add a domain

Domains are created in the dashboard, on the Integration tab.
1

Open the Integration tab

Go to app.shieldlabs.ai and open the Integration tab.
2

Add the domain

Enter the hostname you want to identify visitors on, for example myshop.com. Adding it provisions the domain’s public key, private API key, and secret key.
3

Install the snippet

Drop the snippet onto that domain with its public key in the URL, following Install the snippet for the full client setup.
4

Register webhook endpoints

Add one or more endpoints on the domain’s Webhooks tab so scores are delivered to your server. See Webhooks for registration, verification, and testing.
Adding a domain mints a fresh key set on the spot. The secret key is shown in full only at that moment. Capture it then and store it server-side.

​
What every domain carries

You can read the live configuration for a domain at any time with the Profile endpoint. It returns both keys masked (see keys), so you can confirm a domain without exposing its credentials:
The Profile call is free: it does not consume any of the domain’s requests. Use it as a quick health check that a domain is enabled.

​
Verification is automatic

You do not add a DNS record or upload a file to verify a domain. Verification happens on its own once live snippet traffic is seen.
1

Install the snippet with the domain's public key

The public key only works on the domain it was issued for. The server resolves the domain from the request Origin, then Referer, then Host, and checks it against the public key.
2

Trigger one identify call

Load a page that runs the snippet. The first fingerprint that arrives for that domain marks it as verified in the dashboard.
3

Confirm in the dashboard

The domain flips to verified on the Integration tab once that first call is recorded.
If a public key is served from a host it was not issued for, the identify call is rejected with 401, and the domain stays unverified. A key lifted from your page source will not work on someone else’s site.

​
Subdomains and host matching

A key set is scoped to the exact host you registered. The server resolves the domain from the request Origin, then Referer, then Host, and looks it up against the registered domains. The match is exact, with one normalization: a leading www. is stripped, so www.myshop.com and myshop.com resolve to the same domain. Subdomains do not inherit a parent domain’s key set. app.myshop.com and checkout.myshop.com are distinct hosts: each one you want to identify visitors on needs its own domain entry, with its own public key, secret key, and request totals.
Register each subdomain you serve the snippet on as its own domain. That keeps every host on its own key set and its own request balance, and lets you point each one at different webhook endpoints if you need to.

​
Per-domain isolation

Every domain is a self-contained unit.

Separate credentials

Each domain has its own public key and secret key. A key set issued for one domain authenticates only that domain. Rotating one domain’s keys never touches another’s.

Separate webhooks

Each domain can register up to 10 webhook endpoints. Point them at the same handler or different handlers, as you prefer.

Separate request totals

With multiple domains you can see how the request balance splits across them.

Independent enable state

Disabling one domain stops its identify calls and Server API access without affecting the others.

​
Next steps

With the domain added, wire its public key into the snippet, keep its secret key on your server, and register webhook endpoints that verify X-Shield-Signature per the webhooks guide.