Device & Continuity

Hardware-level, cookieless device fingerprinting that recognises devices and actors across sessions, groups them into clusters, and fuses that with behavioral biometrics and browser-integrity checks. This is the always-on core of the risk snapshot: it needs no external feed or enrollment — the moment the SDK runs, these signals are live.

Device & continuity is an evidence provider. It tells you whether a device is known, stable and behaving like a human — it never blocks. You read the fields and decide.

How it works

The SDK observes the session

The headless browser SDK collects device attributes, network hints and interaction telemetry — no cookie, no visible UI. It fingerprints the hardware/browser and streams behavioral events.

The device is fingerprinted and matched

Backend builds a stable fingerprint and matches it against prior sessions for your merchant — producing knownDevice, stableDevice and the same-device/browser/actor probabilities.

Sessions are clustered

Related devices/actors are grouped into a cluster (matchedClusterId), exposing multi-account operation from one physical device — device farms — with a clusterStabilityScore and clusterRiskScore.

Continuity and behavior are scored

Continuity is graded against history; behavioral biometrics (typing cadence, pointer dynamics, interaction entropy) separate human from scripted; browser-integrity checks flag tampering.

Request

Analyse a session from your backend with your secret key, or drive it from the browser SDK. The device and continuity fields come back in the snapshot either way.

<script src="https://cdn.lunixi.com/lunixi-identity.min.js"></script>
<script>
  // Merchant backend/BFF signs the init; the secret never enters the browser.
  const client = await Lunixi.identity.init({
    sessionBootstrapUrl: '/lunixi/identity/bootstrap',
    subjectId: 'cus_8f2a9c',
    productContext: 'checkout',
  });
 
  const snapshot = await client.analyze();
  // snapshot.knownDevice, snapshot.stableDevice,
  // snapshot.sameActorProbability, snapshot.matchedClusterId ...
</script>

Stream interaction events with POST /api/v1/identity/live-sessions/events/batch (or client.trackBatch(events)) to enrich the behavioral signal over the life of the session before you take a snapshot.

Snapshot

The device and continuity portion of the snapshot:

{
  "knownDevice": true,
  "stableDevice": true,
  "sameDeviceProbability": 0.97,
  "sameBrowserProbability": 0.88,
  "sameActorProbability": 0.74,
  "matchedClusterId": "clu_3b1d",
  "clusterStabilityScore": 0.62,
  "clusterRiskScore": 66,
  "continuityDriftReasons": ["timezone_shift"],
  "similarityScore": 0.38,
  "stabilityScore": 0.55,
 
  "tamperClassification": "tampered",
  "tamperConfidence": 0.81
}

Signals

Field	What it tells you
`knownDevice`	The device has been seen before for this merchant
`stableDevice`	The fingerprint is stable across recent sessions
`sameDeviceProbability`	Likelihood this is the same physical device as prior sessions
`sameBrowserProbability`	Likelihood this is the same browser instance
`sameActorProbability`	Likelihood the same person is behind this and prior sessions
`matchedClusterId`	The device cluster this session matched into (device-farm detection)
`clusterStabilityScore`	How stable that cluster has been over time
`clusterRiskScore`	Aggregate risk of the matched cluster
`continuityDriftReasons`	Why continuity confidence dropped (e.g. new hardware attributes)
`continuityEvidence`	Evidence records behind the continuity match
`similarityScore`	How closely the session matches known good history for the subject
`stabilityScore`	How stable the device/identity signal is across sessions
`tamperClassification`	Browser-integrity/tamper verdict (e.g. clean, tampered)
`tamperConfidence`	Confidence in the tamper verdict

Behavioral biometrics — typing cadence, pointer dynamics and interaction entropy — are folded into the same-actor probability and the finding surface (human vs scripted), rather than surfaced as standalone score fields. Browser integrity covers UA/header mismatch, impossible feature combinations, CDP/devtools residue and canvas/WebGL spoofing, and drives tamperClassification.

Notes

⚠️

Continuity is history-relative. A device seen for the first time — new hardware, or a customer new to your merchant — returns knownDevice: false, low sameDeviceProbability/sameActorProbability, and no cluster match. This is not a red flag by itself; confidence grows over time as the device is seen again. Treat a low continuity score on a first sighting as unknown, not bad.

These signals are default-on: they require no external feed, no seed and no enrollment. They are live the moment the SDK runs.
The device fingerprint is not a cookie and cannot be cleared by the user; it is stable across browser sessions on the same hardware.
Behavioral telemetry improves with volume — stream events over the session (trackBatch) before taking the final snapshot.

Next steps

The Risk Snapshot — the full field reference
Network Intelligence — where the session connected from
Bot & Automation — human vs scripted, in depth
Server-side API — related-sessions and account-links for a cluster

The Risk Snapshot Network Intelligence