BROWSER / FRONTEND

import { DeviceDNA } from "@devicedna/sdk";

const { sessionToken, sessionBinding } = await fetch("/your-server/device-session", { credentials: "include" }).then((r) => r.json());
const dna = await DeviceDNA.init({
  tenantKey: "tenant_...", // workspace key from DeviceDNA
  endpoint: "https://www.devicedna.site",
  sessionToken,
  sessionBinding,
  consent: "granted"
});

const identity = await dna.identify({
  depth: "standard",
  timeoutMs: 2500
});

await fetch("/your-server/device-check", {
  method: "POST",
  headers: { "content-type": "application/json" },
  credentials: "include",
  body: JSON.stringify({ assertion: identity.assertion })
});

YOUR / BACKEND

// Keep this key in server-side environment variables.
const privateKey = process.env.DEVICEDNA_PRIVATE_KEY;
// Your /your-server/device-session route calls DeviceDNA first:
const session = await fetch("https://www.devicedna.site/v1/session", {
  method: "POST",
  headers: { "content-type": "application/json", "authorization": `Bearer ${privateKey}` },
  body: JSON.stringify({ tenantKey: "tenant_...", origin: "https://shop.example.com" })
});
// Return session.token to the authenticated browser request.

// Your backend receives the assertion.
const result = await fetch(
  "https://www.devicedna.site/api/device/session-status",
  {
    method: "POST",
    headers: {
      "content-type": "application/json",
      "authorization": `Bearer ${privateKey}`
    },
    body: JSON.stringify({
      tenantKey: "tenant_...",
      assertion: request.body.assertion
    })
  }
);

const decision = await result.json();
// Bind only verified results to your account policy.
// allow, challenge, or review; never auto-ban on this alone.