API Reference
Reference for the highwire.js factory, collection methods, payload types, helpers, and constants.
HighWire(options?)
Creates an instance. Available as the window.HighWire global (UMD) or as a
named/default export (ESM).
function HighWire(options?: HighWireOptions): HighWireInstance;| Option | Type | Default | Description |
|---|---|---|---|
apiBase | string | https://gateway.highwirepayments.com | Reserved for future use. |
collect(options?)
Gathers device, page, fingerprint, paste, and geolocation signals and packs them into a blob.
collect(options?: CollectOptions): Promise<CollectResult>;const { blob, payload } = await hw.collect({
geolocation: { enabled: false },
});CollectOptions
| Option | Type | Default | Description |
|---|---|---|---|
geolocation.enabled | boolean | true | Set false to skip the browser's native location permission prompt. |
geolocation.timeoutMs | number | 10000 | How long to wait for a position before recording timeout. |
geolocation.highAccuracy | boolean | false | Request high-accuracy positioning. |
fingerprint | GetFingerprint | built-in | Advanced: replace the fingerprint backend, mainly in tests. |
CollectResult
| Field | Type | Description |
|---|---|---|
blob | string | Opaque base64URL string. Forward this as deviceData. |
payload | CollectedPayload | Decoded view of the blob for client-side debugging. Send the blob, not this. |
collect() is fail-safe: individual signal failures (geolocation denied,
fingerprinting blocked) still produce a blob.
observeField(element, fieldName)
Marks a field for paste detection. The tracker listens only for the paste
event and records the fieldName you pass — it never reads the field's
value.
observeField(element: Element, fieldName: string): Unobserve;Returns an Unobserve function (() => void) that removes the listener —
call it when the field unmounts. Pasted field names show up in the payload's
pastedFields array.
Payload types
CollectedPayload — the decoded blob:
| Field | Type | Description |
|---|---|---|
v | number | Blob schema version (currently 1). |
client | string | Library version (currently 0.1.0). |
requestId | string | Unique id (UUID v7) for this collection. |
device | DeviceSignals | Browser and hardware signals. |
page | PageSignals | Page and timing signals. |
fingerprint | FingerprintResult | Device fingerprint. |
pastedFields | string[] | Names of observed fields that received a paste; empty if none. |
geolocation | GeolocationResult | Geolocation outcome (always present). |
DeviceSignals — user agent, language(s), platform, vendor, hardware
concurrency, device memory, screen and window dimensions, color depth, pixel
ratio, timezone and UTC offset. Most fields are nullable — absent signals are
recorded as null, never guessed.
PageSignals — referrer, origin, pathname, search, title, page-load and
collection timestamps, first-seen timestamp (persisted in localStorage),
time on page, and time on site (all times in milliseconds).
FingerprintResult
| Field | Type | Description |
|---|---|---|
visitorId | string | Stable device hash. |
confidence | number | null | Confidence score between 0 and 1, when available. |
bot | boolean? | Declared in the type but not populated in the current build. |
suspectScore | number? | Declared in the type but not populated in the current build. |
GeolocationResult — a union discriminated by source:
source | Extra fields | Meaning |
|---|---|---|
'browser' | latitude, longitude, accuracy | Shopper granted the permission prompt. |
'denied' | — | Shopper denied the permission prompt. |
'unavailable' | — | Geolocation API not available. |
'timeout' | — | No position within timeoutMs. |
'disabled' | — | You passed geolocation: { enabled: false }. |
Helpers and constants
function packBlob(payload: CollectedPayload): string;
function unpackBlob(blob: string): CollectedPayload;
class HighWireError extends Error {
readonly code: string; // 'invalid_blob'
name: 'HighWireError';
}
const HIGHWIRE_JS_VERSION = '0.1.0';
const BLOB_SCHEMA_VERSION = 1;unpackBlob throws a HighWireError with code 'invalid_blob' when given a
malformed blob — useful if you want to inspect a blob while debugging. This
is the only error the library throws.