இந்த மொழிபெயர்ப்பு இயந்திரத்தால் உருவாக்கப்பட்டது; மதிப்பாய்வுக்காக நிலுவையில் உள்ளது.ஆங்கிலத்திற்கு மாறுக
இருண்ட
உள்நுழையவும்செயல்முறை விளக்கத்தைக் கோருங்கள்
இந்தப் பக்கத்தில்
டெவலப்பர் கண்ணோட்டம்

Backend Integration

Read the developer overview first. Its server sample is imported from the executable fixture and is the maintained code path for this guide.

Trust boundary

The browser passes a returned device identifier to your backend. The backend calls the authenticated device lookup with a server-held credential. The browser must never receive the credential, an Authorization header, or a secret environment variable.

The public v1 device route rejects an unauthenticated request. Evaluation access and an appropriately scoped credential are required before the lookup can return a tenant-scoped record.

Handle transport before risk

Your server must preserve these outcomes:

  • Received: a response contains the fields your evaluated policy requires.
  • Missing: no record is present for that identifier in the current tenant and retention window.
  • Invalid: a response exists but lacks fields required by your policy.
  • Rate limited: the service rejected request frequency; follow the supplied operational guidance.
  • Unavailable: authentication, authorization, network, or service failure prevented a usable read.

Only a complete received record belongs in a numeric comparison. Missing, invalid, rate-limited, and unavailable states are not score zero and are not low risk.

Customer policy

Combine the lookup with the protected operation and the account, authentication, transaction, and abuse context your application already owns. Begin in observation mode. Compare the proposed action with confirmed outcomes before adding step-up or deny behavior.

Set an application deadline and choose a fallback for each protected surface. A successful API response does not prove that one threshold is appropriate for every route.

Verification checklist

  • The credential remains in the server secret store.
  • Browser requests carry only the lookup identifier and customer-owned business input.
  • Received, missing, invalid, rate-limited, and unavailable paths are exercised.
  • Logs omit credentials and unnecessary identifiers.
  • Policy changes have an owner, observation evidence, and rollback path.

Use the maintained server sample and then trace the complete Integration Flow.