Search the docs
Find a page or a section of one
Documentation
Build with LayerSift
A persistent visitor ID for every browser and every handset, plus Smart Signals for bots, VPNs, proxies, Tor, incognito, tampering, virtual machines, remote control, root and jailbreak, emulators, app cloning, instrumentation, MitM and location spoofing. One API call.
Getting startedInstall the agent, read a result, verify it server-sideCore conceptsVisitor ID, confidence, environments, roles, keysArchitectureHow the whole system works and why — read this first
Guides
Browser agentEvery option, caching, the framework packagesMobile SDKsAndroid, iOS, React Native, FlutterSmart SignalsWhat each signal means and how to act on itRulesTurn signals into a decision, without a deployProtecting sign-inCredential stuffing and account takeover: at the edge with no code, from your server, or with the agentProtecting checkoutCard testing and card cracking: what to send as card, and the declines that give them away; a checkout's steps taken faster than a person takes them (flow, or ANTIBOT_FLOWS at the edge)Protecting text messagesSMS pumping and SMS bombing: blocks of numbers, codes never entered, texting only where you have customersMeasured against automation toolsPuppeteer, Playwright, Selenium, nodriver, Camoufox, Pydoll, Crawlee and the rest, as shipped and with their evasions: what each scores, what gives it away, and what is not caught yetOWASP automated threatsThe twenty-one threats OWASP names, and for each what is covered, what partly, and what not at allProtecting forms from spamSpam campaigns: one message from many senders, and what your moderators decided, without keeping a word of itProtecting gift cards, vouchers and couponsCodes guessed and PINs cracked: what to send as code, and the refusals that give them awayProtecting stock from being heldCarts, seats and bookings held and never bought: what to send as hold, and the lapses that give it awayProtecting limited releases from scalpersThe line, the cart and the checkout of a drop: one order per door, however the address is rewrittenVirtual waiting roomsQueue-it-style rooms where a spot in line is a verdict with a ticket on itPage scriptsPCI DSS 4.0's 6.4.3 and 11.6.1: every script your payment pages run, authorized with why, and word when a new one runs — from the agent or the browser's own report-only policy
Reference
Server APIRead, search, label and delete identificationsServer SDKsNode, Python, Go, Java, PHP, .NET, Ruby — and their middleware for Express, Next.js, Django, Flask, FastAPI, Rails, Spring, ASP.NET Core and PSR-15WebhooksDelivery, signatures, retriesLog streamsEvery assessment and identification, as it happens, to Splunk, Datadog or your own HTTPS collectorSealed resultsSkip the round trip without trusting the clientWhat the agent storesEvery cookie and storage item it writes, for your cookie notice; what turns each off; where consent questions startManagement APIProvision from a scriptUser provisioning (SCIM)Okta, Entra ID, OneLogin and JumpCloud create, update, deactivate and remove membersOpenAPIEvery endpoint as an OpenAPI 3.1 document, generated from the code and checked in CIErrorsEvery code the API returns
Deployment
First-party integrationCDN proxy and custom subdomains, so blockers have nothing to matchReverse proxiesnginx, Traefik, Caddy, Envoy and Kubernetes: the edge as a forward-auth service your own proxy asksWordPress and WooCommerceA plugin: sign-ins, comments, XML-RPC, REST and checkout assessed before WordPress actsLaravelMiddleware: sign-ins with the starter kits' forms by default, the address Laravel reads, and $request->antibot()SymfonyA bundle: the decision on the request event, sign-ins from form_login's redirects, and the address Symfony reads through framework.trusted_proxiesSpring BootA starter: the client, guard and filter from antibot.* properties, ordered ahead of Spring Security, and the address Spring reads through server.forward-headers-strategyEnvironmentsKeep development, staging and production apartLaunchingThe steps from this repository to a service the public can sign up to, in order, with the check after eachProduction checklistThe settings that depend on what is in front of the app, and what assumes there is only one copy of itReleasing the SDKsVersions that agree, a tag, and the registries the release workflow publishes toBillingThe trial, Pro and Enterprise; what a billable call is; setting Stripe upDeployment architectureOne stack per data region (US, EU, Asia-Pacific) chosen at sign-up, what fails and what it costs, and the providers comparedPrivacyIdentify without retaining IP addresses, and how long identifications are kept