Device Intelligence
Use cside Device Intelligence to identify visitors, collect browser signals, and detect bots, VPNs, proxies, and suspicious browser environments.
cside Device Intelligence collects browser and network signals from real sessions, turns them into a session token, and lets your backend retrieve the resulting datapoints. Use it for fraud checks, account abuse detection, bot measurement, and visitor intelligence.
Device Intelligence is not available for new activations. Teams that already use Device Intelligence, including free, paid, enterprise, and trial teams, keep their access and can continue to manage their plan and API keys. New teams start with client-side security only.
Enable Device Intelligence
New Device Intelligence activations are closed. These setup steps apply to teams that already have access. Keep Device Intelligence enabled under Install Device Intelligence, with at least one managed, non-suspended domain. See availability and collection settings.
- The team needs at least one managed, non-suspended domain before you can enable it. The script only runs on the team’s collecting domains, so enabling a team without one collects nothing.
- Enabling requires an explicit acknowledgment that Device Intelligence collects personal data (PII) from visitors, including IP address, approximate location, and hardware and browser signals. You are responsible for a lawful basis, privacy disclosures, and any consent required under GDPR, CCPA, and other applicable laws.
Once enabled, every managed domain on the team can collect fingerprints. There is no per-domain toggle.
Stop collection
Turning Device Intelligence off in the dashboard changes the team setting; it does not remove collection code from your website. To stop browser collection, remove the package initialization or script bootstrap from every place that deploys it, including your app, HTML templates, Cloudflare Worker, Framer or Webflow custom code, and any script served through a custom domain. Publish those changes and verify that the browser no longer loads or sends Device Intelligence telemetry.
How it works
- Enable Device Intelligence for the team in cside
- Install the npm package or load the cside Device Intelligence script on your site
- Call
sendClientTelemetry(externalIds?)from the browser - Send the returned session token to your backend
- Retrieve the datapoints from cside using the Events API and a backend-only Device Intelligence API key
externalIds is optional. Use it when you want to attach your own account, session, order, or user identifiers to the fingerprint. The built-in rules and the Identity graph key on userId, so pass it when you have one.
Recommended setup
For apps built with a bundler, install @cside.dev/device-intelligence. It bundles the collection code, so there is no remote script to load or block, and it hands back a typed sendClientTelemetry. This is the default method in the dashboard.
When you inject the script into HTML instead, use the DNS setup to serve it from your own domain where possible. cside offers this to avoid privacy concerns around third-party domains, make the script look first-party to the browser, and prevent browser ad blockers or client-side blocking from interfering with the script or impacting detection accuracy. Load it early in the document with the fail-open browser bootstrap.
Datapoint categories
The Events API can return:
- Identification - visitor ID, confidence, first seen, and last seen values
- Browser and device - User-Agent, OS, locale, timezone, platform, plugins, canvas, WebGL, WebGPU, audio, storage, and permission signals
- Network and IP intelligence - IP address, proximity data, VPN, proxy, Tor, and blocklist signals
- Environment checks - incognito mode, tampering, virtual machine, developer tools, replay, and high-activity device signals
- Bot and automation - bot verdict, probability, confidence, identified bot agent, and the reasons behind the classification
The full field reference lives in the Events API.
Next steps
Thanks for your feedback!