Skip to main content
The JavaScript SDK collects browser fingerprint signals, encrypts them, and creates a session with the Antifraud API for fraud scoring.

Installation

Installation

CDN (Script Tag)

Quick Start

Configuration

Initialization throws an error if:
  • projectId is missing or empty
  • publicKey is not a valid PEM string
  • The page is not served over HTTPS or localhost

Methods

client.createSession()

Collects fingerprint, encrypts it with hybrid RSA-OAEP + AES-256-GCM, and sends it to the Antifraud API.
Returns SessionResult: Concurrent calls are deduplicated — only one in-flight request at a time.

Error Handling

All errors are typed classes extending AntifraudClientError. Recommended fail-open pattern:

Exports

Content Security Policy

Add these directives to your CSP:

Browser Support

Requires crypto.subtle (HTTPS or localhost).

Encryption

The SDK uses hybrid encryption:
  • AES-256-GCM for payload encryption (random key per call)
  • RSA-OAEP/SHA-256 to encrypt the AES key
  • Each request produces unique ciphertext
The RSA CryptoKey is cached across calls to avoid repeated key imports.