Skip to main content
POST https://api.tracenow.io/validate The /validate endpoint verifies a device token issued by /identify, enforces single-use replay protection, and returns automation signals for the device. Call this server-side when you receive a dt_... token from the browser. Device tokens are single-use — attempting to validate the same token twice returns an error. This endpoint uses a publishable key.

​
Request

{
  "publishable_key": "pk_live_xxxxxxxxxxxxxxxxxxxx",
  "device_token": "dt_eyJ..."
}
FieldTypeRequiredDescription
publishable_keystringYesPublishable key from your dashboard (pk_live_...).
device_tokenstringYesDevice token (dt_...) returned by /identify.

​
Response

{
  "valid": true,
  "visitor_id": "vis_01J9ZQK2XVBP3N7M4FGHD8R5TW",
  "is_headless": false,
  "automation_detected": false,
  "canvas_randomized": false,
  "timezone_ip_mismatch": false
}
FieldTypeDescription
validbooleanTrue if the token signature is valid and has not been replayed.
visitor_idstringStable device identifier. Consistent with the visitor_id returned by /identify.
is_headlessbooleanTrue if the browser was identified as a headless environment (e.g. Puppeteer, Playwright).
automation_detectedbooleanTrue if automation framework signals were detected (e.g. navigator.webdriver = true).
canvas_randomizedbooleanTrue if canvas output differs from baseline in a pattern consistent with anti-fingerprint tooling.
timezone_ip_mismatchbooleanTrue if the browser-reported timezone does not match the expected timezone for the IP geolocation.

​
Error responses

StatusBodyMeaning
401invalid_tokenToken signature is invalid or expired.
409token_replayedThis token has already been validated (single-use enforcement).
422invalid_keyPublishable key not found or inactive.