glassprint · Docs

Tell humans from agents — and prove how

glassprint is server-authoritative device intelligence: the browser collects behind a fail-closed consent gate, and the server mints the verdict. Start with the architecture, then read the verdict and signal references, wire it into your risk flows, and self-host it inside your own perimeter.

Concepts

How it works

Architecture

Archetype B: the browser collects behind a fail-closed consent gate, the server identifies. The visitorId is server-generated — salted-HMAC, epoch-rotated, and tenant-bound.

Open

The verdict

A typed four-class result — human, declared_agent, undeclared_automation, unknown — with a confidence floor that refuses to guess, the two-tells rule, farble suppression, and Web Bot Auth.

Open

Signals

The nine client probes, the JA4 server tier, and the SmartSignals dictionary {bot, incognito, tampered, inconsistency} plus suspectScore — additive data, not a verdict to act on blindly.

Open

Guides

Wire it into your risk flows

Integrate

Recipes that read the verdict and signals: account-takeover at login, multi-account at signup, agent and bot gating, and step-up authentication.

Open

Operate

Run it yourself

Self-host

Docker, Helm, and Terraform, plus the JA4 edge options (Cloudflare Worker, CloudFront, a Go proxy, or none). Self-host is the shippable SKU today.

Open

Honest status: self-host ships today — you can run the full ingest, verdict, and privacy-rights surface inside your own perimeter now. A managed SaaS is design-partner onboarding, not open self-signup. Identity resolution in the deployed server is exact-match; the fuzzy trained-ML linker exists and is tested but is not yet wired into the live ingest path. The cross-browser deviceId field is present but always null today.

Server-authoritative, consent-native, honest

A spoof-resistant visitorId, a typed human/agent/automation verdict, and additive fraud signals — built so it can't run without consent.

Read the architecture Talk to us