Overview
Real-time counts across your tenant.
What is this?
Live counts for your tenant, refreshed when you open this view. Visitors are unique browser fingerprints; Devices are physical machines seen across browsers; Users are the people darkid speculates behind the traffic — no login required. Flagged counts decisions that weren't a clean allow.
Decisions
Every /v0/collect call produces a real-time decision. Tune the thresholds to allow, challenge, step up, or block.
What is this?
Every /v0/collect call is scored in real time and reconciled with your Agent Policy into a final action — allow, challenge, step up, or block. Each row shows the score, the contributing evidence, and the reason codes. Tune the bands under Risk Policy.
Visitors
Each row is a unique browser fingerprint.
Behavior = in-session consistency (pointer + keystroke timing). Low = the session is being driven differently than before.
What is this?
Each row is one browser fingerprint (a visitorId), stable across reloads and incognito. Behavior is in-session consistency of pointer and keystroke timing — a low score means the session is being driven differently than before. Keystroke contents are never collected.
Devices
One physical device seen across multiple browsers or sessions.
What is this?
A device is one physical machine recognised across different browsers or sessions, linked by a storage-free hardware fingerprint. One device can hold several visitors — one per browser.
Users
darkid speculates the person behind the traffic into an opaque user id — no login required. account = deterministic (a hashed account hint linked devices); device = one recognised device; network = probabilistically linked by repeated shared-network co-occurrence.
What is this?
darkid speculates the person behind the traffic into an opaque userId with a confidence and a basis — account (a hashed login hint you pass), device (one recognised machine), or network (probabilistically linked by repeated shared-network co-occurrence). No sign-up required.
Networks
Devices seen on the same network — a probabilistic signal that they may belong to the same person or household (cross-device).
What is this?
Devices seen on the same network, grouped by an HMAC of the IP — never the raw address. Shared-network co-occurrence is a probabilistic cross-device signal; a busy NAT will not collapse everyone into one person.
API Keys
Publishable keys go in your frontend embed. Secret keys go server-side.
What is this?
Publishable keys (pk_) go in your frontend embed and are safe to expose. Secret keys (sk_) are server-side only. Revoke and rotate here — revocation takes effect immediately.
Install
Add darkid to any page in under 60 seconds.
What is this?
Drop the embed snippet on any page and darkid starts identifying visitors with no further setup. Pass a hashed account hint via the script tag's data-account attribute to link a person's devices once they log in. Lock the key to your domains under Trusted Origins.
Basic embed
Add this tag to your <head> or just before </body>. Swap in your publishable key.
With same-user linking
Pass a hashed user id (SHA-256 of your internal user id is fine) to link browser fingerprints to a single person. Never pass a raw email or PII.
Lock your key to trusted domains
Restrict your publishable key so only requests from your own origins are accepted. Head to Trusted Origins to configure Off / Monitor / Enforce mode and add your domains.
Federated Identity
Enrich the darkid user with a verified Google account anchor for logged-out visitors. Passive: a one-time browser prompt, silent thereafter. Stores only a hashed id — never email or name.
What is this?
Optional, fully passive identity enrichment: a one-time browser prompt anchors a logged-out visitor to a verified Google account, silent thereafter. darkid stores only a hashed id — never an email or name — scoped to your tenant.
Agent Policy
Decide which automated agents are welcome. Verified search engines and accessibility tools are allowed by default; tune AI crawlers, scrapers, and unverified automation per your needs.
What is this?
Not all bots are bad. Verified search engines and accessibility tools are welcome by default; you decide how to treat AI crawlers, user-directed AI agents, scrapers, and unverified automation. Good bots are cryptographically or DNS-verified — a spoofed user-agent alone never counts as verified.
Trusted Origins
Lock your publishable key to origins you control. Off = any origin (default). Monitor = log unlisted origins. Enforce = only verified origins may use the key.
What is this?
Lock your publishable key to origins you control. Off means any origin (the default); Monitor logs unlisted origins so you can build the allowlist; Enforce honors only verified origins. Verify a domain with a well-known file or a DNS TXT record.
Risk Policy
Tune how darkid turns evidence into actions. Thresholds set the score bands; weights scale each evidence family. Changes apply at the edge within ~60s.
What is this?
Thresholds set the score bands (allow / challenge / step up / block); weights scale how much each evidence family — agent, velocity, recency, account — contributes. Changes apply at the edge within about a minute.
Docs
How darkid works — concepts, the signals it reads, and the API. Everything here describes the product you're using right now.
Concepts: visitor, device, user, network
A visitor is a single browser, identified by a fingerprint (its visitorId) that stays stable across reloads and incognito. A device is one physical machine, recognised across multiple browsers via a storage-free hardware fingerprint — so one device contains one or more visitors. A user is the person darkid speculates behind the traffic, clustering devices and account hints into a single opaque userId, with no login required. A network groups devices seen on the same (HMAC'd) IP — a probabilistic cross-device hint, not a hard identity. The nesting is visitor ⊂ device ⊂ user.
Signals collected
darkid identifies a browser from passive, storage-free signals — nothing is written to the device and no prompt is shown. The fingerprint blends device and hardware traits (platform, screen, cores, memory, timezone), rendering signatures (canvas, WebGL, audio), installed fonts, locale and Intl data, UA Client Hints, supported codecs, CSS and voices, and WebGPU adapter traits.
One signal is read at the edge from the request itself — the TLS/HTTP transport fingerprint — which cannot be spoofed from JavaScript. Every signal is hashed, IPs are HMAC'd, and raw PII is never stored.
Risk & actions
Each request gets a risk score from 0 to 1, mapped to an action by your thresholds: allow, challenge, step_up, or block. The score blends the agent verdict (is this automation?), network velocity, fingerprint recency, and account signals.
The action on a decision is the reconciled action — your Agent Policy can override the raw risk action (for example, a verified good bot is allowed even at a higher score). Reason codes such as ip_velocity_high, behavior_anomaly, and device_bound_session explain each decision. Tune the bands and weights under Risk Policy.
Agents
darkid sorts automated traffic into categories — search engines, monitoring, accessibility, feed readers, link preview, SEO, AI crawlers, user-directed AI agents, partner APIs, security scanners, and unverified or malicious automation. A good bot is verified by reverse-and-forward DNS or a published IP range — a matching user-agent alone never verifies.
Agents that sign their requests with Web Bot Auth (RFC 9421 / Ed25519) are cryptographically verified into a distinct signed agent class. You set the disposition (allow, tag, challenge, block, …) per category under Agent Policy; pick a posture — balanced, permissive, or strict — as a starting point.
Protection & identity
Trusted Origins lock your publishable key to domains you control. Off (default) allows any origin; Monitor logs unlisted origins so you can build an allowlist without breaking anything; Enforce serves only verified origins. Verify a domain with a well-known file (/.well-known/darkid-verify.txt) or a DNS TXT record.
Federated ID is optional passive enrichment: a consented, one-time browser prompt anchors a logged-out visitor to a verified Google account, silent thereafter. It stores only a hashed account id, scoped to your tenant — never an email or name.
API / SDK quick reference
Embed — add the script tag from the Install section; darkid attaches window.darkidSDK and exposes the collected signals on window.darkid.
Link a user — add data-account="<your hashed user id>" to the embed script tag (see Install) to link a person's devices once they log in.
Collect response — /v0/collect returns { visitorId, confidence, kind, botScore, action, risk: { score, action, reasons }, agentClass, agentVerified, user: { userId, userConfidence, basis } }. The top-level action is the reconciled decision to enforce (it can differ from risk.action when an Agent Policy applies).
Console endpoints (session-authenticated, read your tenant's data): /v0/stats, /v0/visitors, /v0/devices, /v0/users, /v0/networks, /v0/decisions, /v0/keys, and the config endpoints /v0/policy, /v0/agent-policy, /v0/origins, /v0/fedcm.