Guides
  1. SDK
  2. Web SDK

TruValidate (Iovation) Device Risk Integration

📘

Alloy's SDK supports TruValidate's Third Party Device Risk product. To improve fingerprint success rates, you also need to set up TruValidate's first-party JavaScript integration directly — this runs outside the Alloy SDK and is covered in the First-Party JavaScript Integration section below.

Set Up

Set up the Alloy SDK by following the installation instructions here.

Configure TruValidate in the Alloy Dashboard

  1. Go to Settings > SDK and enable TruValidate using the toggle.

Journey Integration

  1. Call alloy.init() on each page where you want TruValidate to run.
  2. In the alloy.init() callback response, capture the value of iovationBlackboxId.
  3. When you're ready to submit your Journey Application, include the Blackbox in your POST /applications request body under the iovation_blackbox entity payload field.

Workflow Integration

  1. Call alloy.init() on each page where you want TruValidate to run.
  2. In the alloy.init() callback response, capture the value of iovationBlackboxId.
  3. When you're ready to submit your Evaluation, include the Blackbox in your POST /evaluations request body under the iovation_blackbox payload field.

First-Party JavaScript Integration

To increase device fingerprint success rates, deploy TruValidate's first-party JavaScript on the same domain as your Alloy SDK. Once detected, the Alloy SDK will automatically run both the third-party and first-party scripts.

This integration has two components: a static JavaScript file and a reverse proxy.

Deploy the Static JavaScript File

  1. Download the static first-party JavaScript file:
    • Test: https://ci-first.iovation.com/latest/static_wdp.js
    • Production: https://first.iovation.com/latest/static_wdp.js
  2. Deploy the file to a location within your domain that your web pages can access — for example, a CDN like Akamai.
⚠️

The static file must be hosted on the same domain, protocol, and port as the page it's integrated into. Do not host it on a subdomain. Hosting on a subdomain allows fraudsters to block it.

Set Up the Reverse Proxy

The reverse proxy lets the dynamic script (dyn_wdp.js) collect network information and more unique device identifiers alongside the static script.

  1. Add a proxy configuration in your domain that maps /iojs to the appropriate iovation host:
    • Test: https://ci-first.iovation.com
    • Production: https://first.iovation.com
      For example, a request to https://my.domain.com/iojs/latest/dyn_wdp.js should resolve to https://first.iovation.com/latest/dyn_wdp.js.
  2. Start with the test host (https://ci-first.iovation.com) while you validate the integration. Switch to the production host (https://first.iovation.com) when you're ready to go live.

Verify the Integration

Once both components are deployed, confirm the following:

  • No resource loading errors or timeouts in the browser console.
  • Two Blackboxes are generated — one from the first-party script and one from the third-party script.
  • No changes in page appearance, performance, or behavior.

Updated 14 days ago

Did this page help you?