Onboarding your company

Every company follows the same operator-assisted onboarding workflow. Your company owns its product’s identity, site configuration and business decisions; FingerTrackID operates the assessment platform. A workspace can be registered before any customer data or traffic exists.

The console is in Portuguese (pt-BR). This page quotes screen names and buttons exactly as they appear, with an English gloss in parentheses the first time.

Production status

The console and the signed assessment API are live in production, in shadow mode: FingerTrackID recommends and your product decides. Web SDK collection is deployed there too; its end-to-end operation from a customer page is still being measured. Assessments and collection for your application are accepted once the configuration below is complete: the server credential installed with active admission, and the collection domain active. See production status.

1. Request your company workspace

Contact FingerTrackID and provide the company name, a lowercase identifier such as your-company, and the name and email of the person who will administer the company. A FingerTrackID operator creates the company and its first administrator in the protected internal backoffice.

There is no public sign-up form or self-service company creation. Signing in to the console requires an account that FingerTrackID or your company administrator has requested; an account cannot create its own company.

2. Activate the administrator account

When the account is created, FingerTrackID sends an invitation email (in Portuguese) to the administrator’s address, with an Ativar acesso (activate access) button. The email is sent on a best-effort basis: if it does not arrive, the account still exists.

1. Open the invitation and choose Ativar acesso (activate access). On the Ativação de acesso page, enter Nova senha (new password) and Repita a nova senha (repeat it), then choose Ativar acesso. This sets your password and confirms your email in one step. The link is personal and works only once; opening the page does not use it up.

   If the email did not arrive or the link no longer works, ask FingerTrackID to resend the invitation (a new email with a new link, at most 3 times per hour), or open dash.fingertrackid.com, choose Esqueceu sua senha? and enter the administrator email to receive a new link.

2. Sign in with your email and password. Verify your email if asked, then enroll your authenticator app and sign in with the six-digit code.

The complete sequence and the password policy are in signing in. The administrator now holds the Administrador da empresa (company administrator) role.

3. Follow the steps in Início

Open Início (start), at the top of the menu. It lists the five steps your company needs to start receiving real assessments and shows N de 5 etapas concluídas (N of 5 steps done). Visão geral (overview) remains the opening screen; while your company has no active application, it shows a notice pointing to Início. Once your company has received its first access, Início leaves the top of the menu and stays available as Configuração inicial (initial setup) under Configurações (settings), at the end of the menu.

Each of the first four steps becomes a request, normally approved as you send it and recorded in the audit trail, then applied by FingerTrackID’s managed process; the fifth, Primeiro evento recebido, needs no request and completes on its own when the first assessment arrives. A step is shown as Concluída (done) only after the server confirms its effect, never just because the request was sent. Use Recarregar o progresso (reload progress) to refresh.

Step on screen	What you provide	Done when
Criar a aplicação (create the application)	Nome da aplicação, Identificador da aplicação (lowercase letters, digits and hyphen, such as web-app) and Origens permitidas no navegador (one HTTPS origin per line, up to 32)	The application is active
Configurar a coleta web (configure web collection)	Origem registrada da aplicação (one of the origins above, used to set up the collection) and Domínio-base de coleta da sua empresa (your owned base domain, such as yourcompany.com). The other origins of the application under the same domain also collect	The first-party collection domain is active
Credencial servidor a servidor (server credential)	Identificador do cliente de servidor (8–128 letters, digits, hyphen or underscore) and Permissões (permissions). Requisições por segundo is read-only and comes from the application’s managed tier: 5 per second with a burst of 10 on the standard tier (limits)	A current credential exists and its production admission is active
Configuração do SDK (SDK configuration)	Combinação de coleta qualificada (qualified collection combination), available only after the collection domain is active. The step also shows the Chave pública do navegador (browser public key)	Browser collection is configured
Primeiro evento recebido (first event received)	Nothing: it reads integration health	At least one assessment arrived in the last 24 hours

Steps 2 to 5 open only after the application is active. The forms appear only for roles that may submit them: Administrador da empresa and Gestor de integração (integration manager).

Website origins

An origin has HTTPS, no path, port, query or trailing slash. https://app.yourcompany.com/login is a page URL; the allowed origin is https://app.yourcompany.com. Do not use wildcard origins or another company’s domain.

The SDK collects from every allowed origin whose host is your collection’s base domain or one of its subdomains, such as https://yourcompany.com and https://www.yourcompany.com. After the setup, the company administrator or integration manager edits the list in Integração e saúde › Origens das páginas (page origins), with no request: at most 10 origins and at least one; the origin used in the collection setup is marked Principal and cannot be removed there. A removed origin stops collecting at once. Device continuity is per origin: the same browser on two origins counts as two installations.

Collection domain

The collection hostname for the base domain yourcompany.com is collect.yourcompany.com; do not enter the collector hostname as the base domain. The origin you choose must be the base domain or one of its subdomains. The standard web collection observes the browser and recommends monitoring (MONITOR); it does not block anything on its own and makes no calibrated fraud-detection claim.

After you send it, the setup runs by itself. The setup progress of the application in the console lists each step and who moves it:

Label on screen	Meaning
Automático	The platform advances the step by itself: detection, evaluation rules, the collection domain’s certificate, routing and verification, the data custody preset and the final activation. Most steps take a few minutes; the domain also waits for DNS propagation
Depende de você	Publish the DNS records of the collection domain exactly as shown, then choose Verificar agora (check now), or act on what the step says (for example, your CAA policy)
Pausado pelo suporte	FingerTrackID support paused the collection domain; contact support to resume it
Algo travou	An automatic step has not moved for 30 minutes; contact support

Publish the DNS records as described in the collection-domain workflow; verifying the records (also on Verificar agora), renewing the verification, applying the data custody preset and activating the collection need no request to FingerTrackID.

Server credential

Under Permissões, choose Só avaliações (assessments only) or Avaliações, ações e resultados (assessments, actions and outcomes) if your backend will also report feedback. Permissions cannot change on an existing credential; changing them needs a new request. The request rate (standard tier: 5 per second, burst of 10) is a configured admission limit, not a throughput guarantee; Integração e saúde → Limite de requisições shows the limit in force and raises it (limits).

When the credential exists, the step shows only its public key_id. If it says the credential aguarda a aprovação de produção (awaits production approval), assessments are refused until that approval; creating another credential does not help. Your backend authenticates with the key_id, never with the client identifier or the browser public key.

Request states

After you choose Enviar solicitação (send request), the step shows Estado da solicitação (request state) with Recarregar o estado (reload state):

State on screen	Meaning
Aguardando aprovação	Received and waiting for an explicit FingerTrackID approval (only when automatic approval is unavailable); nothing is created yet
Aprovada	Approved; the operational effect is still pending
Em execução	FingerTrackID is applying it
Aguardando você receber o segredo	The server credential’s secret is waiting for an administrator or integration manager to receive it once; it is not usable yet
Aguardando revisão	Collection setup is running its automatic steps; the setup progress says whether a step depends on you
Concluída	Done; the step shows the result
Rejeitada, Cancelada, Falhou	Not completed; read the reason before trying again

If the response is lost, use Repetir a mesma solicitação (repeat the same request) rather than preparing a new one. While a request is Aguardando aprovação, Aprovada, Aguardando você receber o segredo or Aguardando revisão, you can tick the confirmation and choose Cancelar a solicitação pendente (cancel the pending request). Anything already created stays recorded; cancelling is not an undo. FingerTrackID can also cancel a request before the executor takes it, and afterwards suspend or revoke a member or revoke or rotate an integration client; a created application is not undone.

Sending a request uses the session you signed in with; it does not ask for your password or code again. The session ends after 30 minutes without activity or 12 hours after sign-in.

4. Invite your team

The administrator invites people from Membros da equipe (team members) in Início, or with Conceder acesso (grant access) in Usuários e acessos (users and access). Enter E-mail, Nome de exibição (display name) and Papel na empresa (role). Each invitation is a request. When it completes, a person who did not have a console account yet receives the same invitation email, on a best-effort basis. A person who already has a console account (for example, in another company) receives no invitation: they sign out and sign in again to see the new company.

If the invitation did not arrive or the link no longer works, ask for it to be sent again: the company administrator uses Reenviar convite (resend invitation) in Usuários e acessos, and FingerTrackID can resend the first administrator’s invitation. A resend sends a new email with a new link, at most 3 times per hour for each person, and only while the invitation is Pendente (pending). The person can also use Esqueceu sua senha? on the sign-in screen.

In Usuários e acessos, Gerenciar o acesso (manage access) offers Trocar o papel (change role), Suspender o acesso, Restaurar o acesso and Revogar o acesso (revoke). Revoking is permanent. The company’s last active administrator is protected. See the role boundaries.

5. Receive the HMAC secret once, in the console

The signing key is 32 cryptographically random bytes, represented as canonical hexadecimal text with 64 characters. The HMAC signer uses the decoded bytes, not that text.

FingerTrackID generates the secret for you. A few minutes after the credential request, the Segredo da credencial de servidor card (in Início, at the credential step, and in Integração e saúde) shows Pronto para receber. A company administrator or integration manager, signed in with the authenticator code, clicks Receber segredo, reads the warning and confirms. The console shows the key_id and the 64-character hexadecimal secret once, with a copy button. Put the secret straight into your backend’s secret manager before leaving the screen.

• The secret is shown a single time. It is not stored by the console, not sent by email and not shown again; if it is lost, choose Trocar segredo in Integração e saúde once the credential is active: a new secret is generated and delivered once.
• After you receive it, the card shows Entregue, ativando a credencial and the credential becomes usable within a few minutes, with no further action.
• Never paste the value into chat, email, a support ticket, a form, a command argument, terminal output, a local file, a repository or an AI-readable environment.

Who receives the secret

Only a TENANT_ADMIN or INTEGRATION_MANAGER of the company receives it, on a session that completed the second factor. Each delivery is recorded in the audit trail with who and when, never the value. While the request shows Aguardando você receber o segredo, the credential cannot be used; knowing a key_id does not make it usable.

6. Receive the integration inputs

Input	Where you use it
API origin https://api.fingertrackid.com, shown as Endereço da API de risco in Credencial servidor a servidor	Backend configuration, exactly as written, with no path or trailing slash
Application ID, browser public key and allowed origins (Integração e saúde › Origens das páginas)	Application selection and browser configuration
Exact active collection origin and issued DNS records	Browser configuration, CSP and your DNS provider
Credential key_id, encoding and permissions	Backend signing configuration; the value stays in secret custody
Approved rate and burst	Bounded backend retries and capacity configuration
Approved private SDK archive, exact version, SHA-256 and SHA-512	Your frontend dependency process; download it and see both digests in the dash, in Início › Configuração do SDK
The request profile you send (v1.1 with your own tags, recommended and accepted in production; or the v1 journeys, unchanged) and the effective policy/release versions	Request validation and response interpretation
Retention configuration and activation confirmation	Your operational readiness record

Values come from your actual configuration and the verified handoff. Documentation examples and another company’s settings are not issued values. The Web SDK is delivered as an approved private archive; it has no public npm package or CDN URL. The optional server SDK for Node.js is a public npm package.

7. Verify and activate the application

Before real data, FingerTrackID confirms security testing, independent authentication-isolation proof, applied technical retention, and operational qualification including recovery. Your application also needs current first-party ownership/DNS/TLS/health verification, an installed credential, approved admission and an active qualified release and policy. Registering a company does not waive them.

FingerTrackID keeps the data it records for at least 10 years, until further notice, and deletes none of it (retention). The managed setup applies this permanent retention to your company by itself.

Prepare browser collection and the signed backend integration with the implementation handoff. Validate synthetic requests, normal authentication and failure behavior, then finish the integration checklist. Enable real traffic only after FingerTrackID confirms your application’s activation. Start in SHADOW and keep your product’s existing decisions. Browser SDK activation and signed API activation are confirmed separately.