Node and browser SDKs

Node decisions

The Node SDK uses a 600 ms total decision budget and at most one eligible retry. Local outage results have source: local_outage and no Veltor decision ID. Store the claim and actual grant for later reconciliation.

import { Veltor } from "@veltor/node";
const veltor = new Veltor({
  key: process.env.VELTOR_SECRET_KEY!,
  outage: "throw" // Explicitly choose throw, allow, or deny.
});
const result = await veltor.decide({
  "benefit": "signup_credits",
  "claim_id": "signup_customer_123",
  "subject": {"external_id": "customer_123", "email": "alex@example.com"},
  "context": {"ip": "192.0.2.1"}
}, "attempt_customer_123");
if (result.source === "veltor" && result.decision === "allow") {
  // Commit your benefit once and enqueue its outcome durably.
}

Browser observations

Enable collection in organization settings, register exact origins, and create a publishable browser key. The SDK starts only when enabled and its consent callback returns true. It bundles FingerprintJS v5 with monitoring disabled and stores a first-party random browser ID in local storage.

import { observe } from "@veltor/browser";
const observation = await observe({
  enabled: true,
  consent: () => yourConsentManager.hasConsent(),
  key: "YOUR_PUBLISHABLE_KEY",
  claimId: "signup_customer_123"
});
// Send observation.token to your backend when available.
// Your backend supplies it as identifiers.device_token.

Unavailable observations

Collection has a one-second budget. Disabled, blocked, declined, or timed-out collection returns unavailable. Submit the claim without a device token and keep the missing signal explicit. Never substitute a fabricated device ID. Tokens expire after five minutes and are scoped to organization, environment, origin, claim, and nonce.

Observation limits

Only derived identifiers and algorithm versions are transmitted. Signed tokens attest to the observation’s origin and integrity. They do not prove a unique human or prevent a client from fabricating browser evidence.