Fingerprinting

cside fingerprinting collects browser and network signals from real sessions, turns them into a session token, and lets your backend retrieve the resulting datapoints. Use it for fraud checks, account abuse detection, bot measurement, and visitor intelligence.

How it works

1. Add the cside fingerprinting script to your site
2. Call sendClientTelemetry(externalIds?) from the browser
3. Send the returned session token to your backend
4. Retrieve the datapoints from cside using the Events API

externalIds is optional. Use it when you want to attach your own account, session, order, or user identifiers to the fingerprint.

Recommended setup

Use the DNS setup to use your own domain where possible. cside offers this to avoid privacy concerns around third-party domains, make the script look first-party to the browser, and prevent browser ad blockers or client-side blocking from interfering with the script or impacting detection accuracy.

For production, prefer a direct integration that loads early in the document. Google Tag Manager is useful for quick validation, but it does not guarantee script load order.

Datapoint categories

The Events API can return:

• Identification - visitor ID, confidence, first seen, and last seen values
• Browser and device - User-Agent, OS, locale, timezone, platform, plugins, canvas, WebGL, WebGPU, audio, storage, and permission signals
• Network and IP intelligence - IP address, proximity data, VPN, proxy, Tor, and blocklist signals
• Environment checks - incognito mode, tampering, virtual machine, developer tools, replay, and high-activity device signals
• Bot and automation - bot category, headless browser indicators, and automation-related signals

The full field reference lives in the Events API.

Next steps

• Set up fingerprinting
• Use Cloudflare Workers
• Retrieve datapoints
• Detect AI agents and bots
• Read the Events API reference