1. Collect in the browser
The public loader is the only currently verified browser release. It emits a device identifier or an error state; it never receives a server credential.
<script src="https://collect.noxtica.com/collector/noxtica-collector-core.js" data-site-key="pk_example_replace_me" data-extensions="auto" data-auto-init data-auto-check-once async></script>
<script>
document.addEventListener('noxtica:collected', (event) => {
const deviceId = event.detail?.fingerprintId;
document.dispatchEvent(new CustomEvent('app:noxtica-evidence', {
detail: deviceId ? { state: 'received', deviceId } : { state: 'invalid' },
}));
});
document.addEventListener('noxtica:error', () => {
document.dispatchEvent(new CustomEvent('app:noxtica-evidence', {
detail: { state: 'unavailable' },
}));
});
</script>
2. Read on your server
Send the device identifier to your backend, then call the authenticated v1 route with a server-held key.
export async function lookupDevice({ deviceId, apiKey, fetchImpl = fetch }) {
const response = await fetchImpl(
`https://collect.noxtica.com/v1/device/${encodeURIComponent(deviceId)}`,
{ headers: { Authorization: `Bearer ${apiKey}` } },
);
if (response.status === 404) return { state: 'missing' };
if (response.status === 429) return { state: 'rate_limited' };
if (!response.ok) return { state: 'unavailable' };
return { state: 'received', record: await response.json() };
}
3. Keep result states separate
Only a complete received record enters numeric policy. Missing, invalid, rate-limited, and unavailable states follow explicit customer fallbacks.
export function classifyLookup(result) {
if (!result || result.state === 'unavailable') return { state: 'unavailable' };
if (result.state === 'rate_limited') return { state: 'rate_limited' };
if (result.state === 'missing') return { state: 'missing' };
const record = result.record;
if (!record || typeof record.score !== 'number' || typeof record.confidence !== 'number') {
return { state: 'invalid' };
}
return {
state: 'received',
score: record.score,
riskLevel: record.riskLevel,
confidence: record.confidence,
};
}