Collect device signals in the browser with a public API key (kv_pk_…). Send the billable event_id / requestId to your backend and verify on the server.
CDN and browser SDKs use public keys only. Never put kv_sk_… or whsec_… in frontend code.
start() can also take an explicit key: start('kv_pk_…') or start({ apiKey: 'kv_pk_…', endpoint: 'https://api.keverd.com' }) if you are not loading from the keyed CDN path.
const result = await Keverd.getVisitorData();console.log(result.visitor_id); // persistent device idconsole.log(result.event_id); // send to your serverconsole.log(result.risk_score); // UI hint onlyconsole.log(result.browser); // e.g. "Chrome"
Canonical fields are visitor_id, event_id, risk_score, browser. Extra keys are aliases (same values) so older installed SDKs keep working. Collect does not return authoritative action / reasons — use POST /v2/verify.Send this to your backend (JSON body example):