NonaShield Web Fingerprint - Integration Guide

NonaShield Web Fingerprint recognises returning browsers and flags automation or virtual machines. A browser that holds a passkey for your site is recognised with the stronger PASSKEY_VERIFIED tier; every other visit is SOFTWARE_HEURISTIC. The browser never receives a verdict. Your own server asks NonaShield for it.

What NonaShield sends you

The sealing key the browser needs is fetched automatically by the agent. You do not paste it anywhere.

Step 1 - Check your page origin

The page that loads the agent must be served from one of the allowed origins above. To use your own domain, tell us the exact origin (for example https://www.yourbank.com) and we will register it for you.

Step 2 - Add the agent to your page

The agent is a standard ES module served from NonaShield. Add this to the page:

<script type="module">
  import { NonaShieldWebAgent } from 'https://api.diimeai.com/agent.js';

  const agent = new NonaShieldWebAgent({
    apiBaseUrl: 'https://api.diimeai.com',
    webKey: 'YOUR_WEB_KEY',
  });

  const { requestId } = await agent.identify();   // passive, no prompt shown
  // Send requestId to your own backend (Step 3).
</script>

It must be type="module". A plain <script src> will not work.

identify() never throws. If anything fails it returns requestId: null, so it cannot break your page. The agent sets no cookies and uses no web storage.

Step 3 - Optional: passkey recognition at login

Call these from a click or tap handler (browsers require a user gesture for passkeys):

const login = await agent.onLogin();            // { requestId, passkey }
const action = await agent.onHighValueAction(); // same flow, for e.g. a payment

passkey is 'verified' (existing passkey used), 'registered' (new passkey created), or 'unavailable' (unsupported, dismissed, or rejected).

Step 4 - Read the verdict from your server

Pass the requestId from the browser to your backend, then call:

curl -s https://api.diimeai.com/api/v1/verify/web/<requestId> \
  -H "X-Api-Key: <your server API key>"

Response fields: visitorId, trustTier, riskScore (0-100), verdict (ALLOW, REVIEW or BLOCK), flags, origin, ip, country, createdAt.

Act on the verdict in your own code (for example, step up authentication on REVIEW). NonaShield reports what it observed; the decision stays yours.

If something goes wrong

Questions: contactus@diimeai.com