High Wire Payments

API Reference

Reference for the highwire.js factory, collection methods, payload types, helpers, and constants.

HighWire(options?)

Creates an instance. Available as the window.HighWire global (UMD) or as a named/default export (ESM).

function HighWire(options?: HighWireOptions): HighWireInstance;
OptionTypeDefaultDescription
apiBasestringhttps://gateway.highwirepayments.comReserved for future use.

collect(options?)

Gathers device, page, fingerprint, paste, and geolocation signals and packs them into a blob.

collect(options?: CollectOptions): Promise<CollectResult>;
const { blob, payload } = await hw.collect({
  geolocation: { enabled: false },
});

CollectOptions

OptionTypeDefaultDescription
geolocation.enabledbooleantrueSet false to skip the browser's native location permission prompt.
geolocation.timeoutMsnumber10000How long to wait for a position before recording timeout.
geolocation.highAccuracybooleanfalseRequest high-accuracy positioning.
fingerprintGetFingerprintbuilt-inAdvanced: replace the fingerprint backend, mainly in tests.

CollectResult

FieldTypeDescription
blobstringOpaque base64URL string. Forward this as deviceData.
payloadCollectedPayloadDecoded view of the blob for client-side debugging. Send the blob, not this.

collect() is fail-safe: individual signal failures (geolocation denied, fingerprinting blocked) still produce a blob.

observeField(element, fieldName)

Marks a field for paste detection. The tracker listens only for the paste event and records the fieldName you pass — it never reads the field's value.

observeField(element: Element, fieldName: string): Unobserve;

Returns an Unobserve function (() => void) that removes the listener — call it when the field unmounts. Pasted field names show up in the payload's pastedFields array.

Payload types

CollectedPayload — the decoded blob:

FieldTypeDescription
vnumberBlob schema version (currently 1).
clientstringLibrary version (currently 0.1.0).
requestIdstringUnique id (UUID v7) for this collection.
deviceDeviceSignalsBrowser and hardware signals.
pagePageSignalsPage and timing signals.
fingerprintFingerprintResultDevice fingerprint.
pastedFieldsstring[]Names of observed fields that received a paste; empty if none.
geolocationGeolocationResultGeolocation outcome (always present).

DeviceSignals — user agent, language(s), platform, vendor, hardware concurrency, device memory, screen and window dimensions, color depth, pixel ratio, timezone and UTC offset. Most fields are nullable — absent signals are recorded as null, never guessed.

PageSignals — referrer, origin, pathname, search, title, page-load and collection timestamps, first-seen timestamp (persisted in localStorage), time on page, and time on site (all times in milliseconds).

FingerprintResult

FieldTypeDescription
visitorIdstringStable device hash.
confidencenumber | nullConfidence score between 0 and 1, when available.
botboolean?Declared in the type but not populated in the current build.
suspectScorenumber?Declared in the type but not populated in the current build.

GeolocationResult — a union discriminated by source:

sourceExtra fieldsMeaning
'browser'latitude, longitude, accuracyShopper granted the permission prompt.
'denied'Shopper denied the permission prompt.
'unavailable'Geolocation API not available.
'timeout'No position within timeoutMs.
'disabled'You passed geolocation: { enabled: false }.

Helpers and constants

function packBlob(payload: CollectedPayload): string;
function unpackBlob(blob: string): CollectedPayload;

class HighWireError extends Error {
  readonly code: string; // 'invalid_blob'
  name: 'HighWireError';
}

const HIGHWIRE_JS_VERSION = '0.1.0';
const BLOB_SCHEMA_VERSION = 1;

unpackBlob throws a HighWireError with code 'invalid_blob' when given a malformed blob — useful if you want to inspect a blob while debugging. This is the only error the library throws.

On this page