Dashboard

The dashboard shows your projects' events as they come in, and everything a reviewer needs to look into one without writing code. Anyone can sign up with their name, company and a permanent email address (addresses at disposable email services are refused), and teammates join through an invite sent by email. Each account sees the projects it's a teammate on, switches between them in the menu's project switcher, and creates new ones there.

How it's organised: an account is a teammate on one or more projects, and every teammate of a project can do everything in it but what can't be undone (removing teammates, deleting keys, replacing secrets, shortening the retention, deleting the project), which only its owner (who created it) can. Projects belong to an organization, which holds their billing currency and their bill; everyone on one of its projects is in it.

The pages below follow the menu, top to bottom. The search at the top of the menu takes a visitor ID, external ID, IP or request ID, or the name of a page.

To fill a new project with test events without code, use the /demo page.

The project's last 30 days at a glance: identifications, this month so far with its billing date, the latest events, the top signals and the most suspicious events, each linking on. A new project shows its first steps here instead (a public key's snippet, reading an event, a test webhook), and a warning while its allowed origins are empty, since any site can identify with its public key until they're set.

Events

Every event of the project, newest first. Live refreshes as they come in. The filter button opens the filters: visitor, external ID, IP, request ID, country, website, network, browser, OS, action, signal, bot verdict and minimum risk score, each "is" or "is any of". The period picker sets the dates, and the ⋮ menu switches between loading more and pages, and between your time zone and UTC. Every filter is in the page's address, so a filtered list can be bookmarked or shared with a teammate; that also puts the external IDs and IPs you filter by in your browser's history.

Event page

One event the way your server sees it, top to bottom:

Visitor: the visitor's week (its events, IPs and countries), its event count, how many events in the last 24 hours, its IPs this week and the event's confidence, with when it was first seen.
Risk score: the score with a verdict and a band: Low risk below 5 ("Looks like a real person"), Some risk from 5 to 14 ("A few things stand out"), High risk from 15 or for a bad bot ("Looks suspicious", or "Looks like a bot"). These bands describe the score; why they differ from the decision bands is in Smart signals › Starting bands. Under it, where the score stands in the project's last 30 days: "Higher than 62% of this project's events in the last 30 days, the same as 20%" means 62% scored lower and 20% the same. A project whose events all score alike says so instead.
Why this score: each signal that fired with the points it added, strongest first, so they add up to the score (the event's riskScoreBreakdown, with the weights in force when it was identified). A signal can add nothing when a stronger one of its kind already counts, and a bad bot is topped up to 15. Under it, the checks that couldn't run for this event and why: they add no points, so a low score with them isn't a clean one.
Signals: each signal that fired, what it means, and what this event showed, like the WebGL renderer for Software renderer, the client a TLS handshake came from for TLS mismatch, or the browser's and the IP's time zones. Raw shows the event's fields behind it and Learn more its entry in Smart signals. The other checks, passed or not run, are folded away under it.
Velocity: the counts of the last 5 minutes, hour and 24 hours, up to and including this event. "Visitors of the external ID" is distinctVisitorIdByExternalId: the visitors (browsers) the external ID was seen with.
Device and location: the browser, the IP's owner and location (under a VPN, the exit's), and Kept until.

Events from this IP and Visitor history open the other events of the IP and the visitor; Show JSON shows the raw event, as the API returns it.

Signals

A tile per signal over the period you pick: how many events had it and what share of all events that is. Open a tile for those events. What each signal means, how sure it is and what to do about it is in Smart signals.

Insights

Charts of the project's events, like Amplitude's event segmentation. Pick what to measure (identifications, unique visitors, unique external IDs, the share with signals, the average, median or 90th percentile risk score, identifications per visitor, bad bots), filter, and group by up to two properties: country, city, browser, OS, network, IP company, website, API key, action, signal, bot verdict, risk level, whether there's an external ID, hour or day of the week. Compare with the period before, a week, a month or a year earlier.

Your external IDs and what links them, the dashboard side of Related. Search for an external ID to see its visitor IDs and IPs, whether it shares a visitor with another external ID (a duplicate), or that it was never seen in a browser. Its related external IDs show as a tree, a network graph (drag to pin, zoom, filter) or a table, a few hops out. Most shared lists the values more than one external ID shares. How to read the links is in Related › Reading the links.

Usage

Identifications per day over the period you pick (per hour for 24 hours), against the period before, with throttled requests (refused by a budget or limit) and how often each signal fired. This billing period shows the month so far and an estimated bill. Narrow it to one key with the key filter.

API keys

The server API and agent endpoints and the project's public and secret keys, each with a snippet to paste, its usage this month and an optional monthly spend limit. A public key stays visible; a secret key is shown in full once, when you create it. Each key has its own page with its settings, requests per day, this month against its limit, when it was created and last used, and, for a public key, its events. See Keys and billing.

Webhooks

The endpoint url new events are POSTed to, its signing secret, a test event, the last 30 days' success rate and response times, and every delivery with its attempts. See Webhooks.

Team

Everyone on the project by name, with their email, and open invites. Invite someone by email: they get a link that works for a week, from you by name and company (never your email), and someone who already has an account sees the invite in their notifications. The one who created the project is its owner, marked Owner, and it can't leave the project or be removed. Only the owner can do what can't be undone: remove a teammate, revoke or clear an invite, delete an API key, rotate the webhook secret, create or replace the encryption key, remove the custom domain, shorten the data retention (a shorter limit, or any limit after keeping events indefinitely) and delete the project; the dashboard hides those controls from members. Every other teammate is a member and can do everything else: invite people, create, edit and disable keys, make the first webhook secret, keep events longer, and leave the project.

Settings

The origins allowed to identify with the project's public keys, privacy options (zero trust mode, retention, page URLs, sealed results), the socket proof, support access, the risk score's weights, and deleting the project. See Project settings.

Your profile

Your name and company, your password, log out every browser, or delete your account (once the projects you own are deleted). Your email is the one you signed up with; it can't be changed. Forgot password? on the login page emails a reset link.

Your organizations. Every organization you're in, with its projects you're on and your role on each, Owner or Member (projects without an organization are listed last). Open a project to switch the dashboard to it, or leave it: you lose access at once and its audit log records it. A project you own can't be left, nor one you're the only member of; delete it instead.

Two-factor authentication. Turn it on to need a code from an authenticator app (1Password, Google Authenticator, Authy and the like) after your password: scan the QR code, type the app's first code and your password, and save the ten recovery codes shown once. Each recovery code logs you in once if you lose the app; make new ones, or turn two-factor off, with your password (and a code to turn it off). With two-factor on, every way of logging in asks for the code, a password reset included. Lost the app and the codes? Our support can turn it off once you've proved who you are, and you get an email when they do.

Browsers. Each login identifies your browser with our own service, and your profile lists the browsers you logged in from, with where and when. Without two-factor, logging in with your password from a browser you haven't used before, your first one included, takes a 6 digit code we email you, which the login page asks for. A new browser that didn't need the code (with two-factor on, or through a link we emailed you, like a password reset, which already proves your address) sends you a "New sign-in" email instead, with a link to review your browsers and to reset your password if it wasn't you. Forgetting a browser makes its next login count as new; it doesn't log it out (Log out everywhere does).

Login history. The last 30 days of logins, wrong passwords and codes, new and forgotten browsers, and changes to your password and two-factor, each with its browser, place and IP address. We keep it 90 days.

Organization settings

The organization's name and billing currency (for all its projects; new organizations start with your country's when we bill in it, else euros), and its projects.

Billing

The organization's month so far, an invoice per month for all its projects, this month by project, budgets for the organization and the project, the usage limit, and the price steps. Billing isn't live yet, so the amounts are estimates.

Audit log

Who changed what in the organization and every one of its projects, newest first: the organization's name, billing currency and budgets, projects created and deleted, keys created, changed and revoked, project settings and secrets, the teams, visitors and external IDs erased through the API (by which key, never which visitor), and support's visits. Only owners can read it: whoever owns one of the organization's projects. Each entry has when, the project (or Organization for the organization's own changes), who (an account, a key or Support), the change, where it came from (Dashboard, Server API or Support) and the IP, with a popover about the IP. Filter by project, category and origin, search by who, and export as CSV. Logins aren't in it, as they belong to no organization.

Notifications

The bell next to the gear: invites to other projects, and support asking to read a project's data, which any teammate can allow for 12 hours or refuse.

Say an account, user-5120, looks off: a new signup that ordered right away with a coupon. Without any code:

Find its events. Search for user-5120, or on Events filter External ID is user-5120. Open its signup event (action signup, if your site sets one).
Read the score and the signals. High risk or a bad bot is a strong sign. In Smart signals › Detected, check what fired, and for each the "How sure" column in Smart signals: a VPN alone means little, tampering or automation a lot.
Look at the visitor. In the visitor summary and Visitor history: was this browser here before (returning), and with which other external IDs? Velocity's "External IDs" in 24 hours above 2 means the browser was used for several accounts.
Follow the links. On Related, search user-5120: duplicate means it shares a browser with another external ID. Open its related external IDs as a tree: a cluster around one visitor ID is a ring; a cluster around one IP may be an office or a VPN.
Weigh it. A shared visitor is a lead, not proof (why). Several signals pointing the same way (a shared visitor, a fresh account, tampering, a coupon already used by the linked account) make a case.
Act in your own system: hold the order, ask for verification, or close the account. The dashboard reads; it doesn't block anyone, and it doesn't erase data either: erasing a visitor or an external ID goes through the server API.

Changing the risk score's weights in Settings only scores new events. The events you're reviewing keep the score they were given when they were identified.