deviceId, a riskScore, and the specific signals that contributed to the score.
Persistent device ID
Unlike advertising IDs or cookie-based identifiers, the OTPless device ID is engineered to survive events that normally reset tracking:- App reinstalls
- Factory resets
- OS updates
- Advertising ID resets
Risk score
Every call togetDeviceIntelligence() returns a risk score from 0 to 100.
These thresholds are a starting point. Set your own cut-offs based on the sensitivity of the action being performed.
Risk signals
The risk score is derived from a set of device signals. Signals are returned server-side only — they are not included in the client response.How to act on the score
Allow
Low score — no unusual signals. Continue the user’s session without interruption.
Step-up
Elevated score — require an additional verification factor before allowing a sensitive action.
Block
High score or critical signal (e.g. emulator, tampered) — deny the request and surface an appropriate error.
When to use it
- Account creation — flag devices with high risk scores before an account is created
- Login — identify repeat offenders across account resets
- Transactions — add a device-level check before fund transfers or profile changes
- Abuse prevention — detect emulators used in bulk account creation or credential stuffing
Platform support
Risk signals are served server-side only. Your backend receives the full signal set; the client response includes only
deviceId and riskScore.Integration
Native SDK for Android and iOS — passive, no login widget, no Pre-Built UI or Headless split.Android SDK
Add Device Fingerprint to your Android app.