Browser SDK

The SDK is a single script, under 4 KB, with no dependencies. It computes an opaque device token so BurnGuard can notice one browser creating many accounts, even when every email is different.

Install

<script src="https://YOUR-BURNGUARD-HOST/sdk.js" data-key="bg_pk_your_publishable_key" defer></script>

Use your publishable key (bg_pk_…). Never put a secret key in the browser.

Classic forms

Add data-burnguard to your signup form. The SDK injects a hidden input named bg_device before the form submits:

<form method="post" action="/signup" data-burnguard>
  <input type="email" name="email" required>
  <button>Sign up</button>
</form>

On your server, read bg_device from the form body and pass it as device_token to /v1/check.

Single-page apps

const deviceToken = await window.BurnGuard?.token().catch(() => undefined);

await fetch("/api/signup", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ email, password, deviceToken }),
});

If the script was blocked by an extension, window.BurnGuard is undefined. Send the signup anyway; BurnGuard simply scores without the device signal.

What the token is made of

The token is a hash of a few stable browser properties (for example screen size, timezone, languages, platform, hardware concurrency and the graphics renderer) combined with a random first-party id kept in localStorage. We never receive the raw values, only the hash.

• No cookies are set.
• Nothing is shared across different customers' sites: tokens are namespaced by your publishable key.
• It isn't a cross-site tracking identifier, and it doesn't call any third party.

Privacy note

Tell users in your privacy policy that you use a fraud-prevention service at signup. Fraud prevention is a recognized legitimate interest under GDPR (Recital 47). See our DPA summary.