---
title: Device Fingerprint Snippet
slug: extensions/device-fingerprint-snippet
docTags: 
createdAt: 2026-09-22T18:20:22.602Z
---

Forter's device-fingerprint JavaScript collects behavioral signals (mouse movement, typing cadence, device fingerprinting) on every storefront page, from landing through checkout.

Once `forterEnabled` and `forterSiteID` are set (see [Configure Decisions](https://docs.forter.com/extensions/configure-decisions)), it injects automatically. No template changes are needed.

```mermaid
sequenceDiagram
    participant Browser
    participant SFCC
    participant Forter CDN

    Browser->>SFCC: Any page load
    SFCC-->>Browser: Inject Forter JS snippet (afterFooter hook)
    Browser->>Forter CDN: Collect behavioral signals (async)
    Forter CDN--)Browser: ftr:tokenReady event
    Browser->>SFCC: POST token → ForterToken-SaveToken
    Note over SFCC: Token stored in session.privacy.ftrToken
```

## How it works

1. On `ftr:tokenReady`, the snippet POSTs the token to `ForterToken-SaveToken`, which stores it as `session.privacy.ftrToken`.
2. From there, every Forter API call made during the rest of the session reads the token from `session.privacy.ftrToken` and includes it: order validation, login attempts, profile updates, and account changes.
3. The token isn't cleared after use. It stays in the session until a fresh `ftr:tokenReady` event overwrites it or the session expires.

## Content-Security-Policy

The snippet loads via inline `<script>` tags rather than a static `<script src>`. If your storefront enforces a strict Content-Security-Policy, the snippet may not load — contact your Forter implementation team about compatibility options for your site.