Skip to main content

​
Overview

In this quickstart, you’ll add Fingerprint to a Python backend using the web framework FastAPI to prevent fraudulent account creation. The example use case we’ll use for this quickstart is stopping new account fraud, where attackers create multiple fake accounts to abuse promotions, exploit systems, or evade bans. However, the steps you’ll follow apply to most use cases. You can flag and block suspicious users by identifying the device behind each sign-up attempt, login, or transaction. In this quickstart, you’ll learn how to:
  • Set up a FastAPI server with a Fingerprint integration
  • Retrieve visitor identification data using the Server API
  • Block bots and suspicious devices
  • Prevent multiple signups from the same device
This guide focuses on the back-end integration and must be completed after identifying a visitor and generating a request ID. Before starting this quickstart, start with one of our front-end or mobile quickstarts to see how to identify a visitor in your front-end.
Estimated time: < 10 minutes

​
Prerequisites

Before you begin, make sure you have the following:
  • A completed front-end or mobile Fingerprint implementation (See our quickstarts)
  • Python (3.8 or later) installed
  • Your favorite code editor
  • Basic knowledge of Python

​
1. Get your secret API key

Before starting this quickstart, you should already have a front-end Fingerprint implementation that sends the requestId to your server. If not, pause here and check out one of our front-end or mobile quickstarts first.
If you’re ready:
  1. Sign in and go to the API keys page in the Fingerprint dashboard.
  2. Create a new secret API key.
  3. Copy it somewhere safe so you can use it to retrieve full visitor identification data from the Server API.

​
2. Set up your project

To get started, set up a basic server. If you already have a project you want to use, you can skip to the next section.
  1. Create a new Python project and set up the virtual environment:
Terminal
mkdir fingerprint-python-starter && cd fingerprint-python-starter
python -m venv venv
source venv/bin/activate  # On Windows: venv\\Scripts\\activate
  1. Create a requirements.txt file with the dependencies:
requirements.txt
fastapi==0.115.6
uvicorn[standard]==0.32.1
python-multipart==0.0.20
pydantic==2.10.4
python-dotenv==1.0.1
fingerprint-pro-server-api-sdk==8.7.0
  1. Install dependencies from the requirements.txt file:
Terminal
pip install -r requirements.txt
Note: This quickstart is written for Fingerprint SDK version 8.x
  1. Create a new file called server.py and add a basic FastAPI server setup:
server.py
from fastapi import FastAPI, HTTPException
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()

# Add CORS middleware for local development
app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],  # In production, specify your frontend domain
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

@app.post("/api/create-account")
async def create_account():
    # We'll add Fingerprint logic here
    return {"status": "ok"}

if __name__ == "__main__":
    import uvicorn
    uvicorn.run(app, host="0.0.0.0", port=3000)
Here we are running the server at port 3000 and have created a new POST route for account creation. Note that the /api/create-account route should match what you have set up in your front-end implementation where you are sending the Fingerprint requestId to your server. Your server will receive the initial identification information from identifying a visitor on the front end and use it to get the full visitor data on the back end.

​
3. Initialize Fingerprint and retrieve visitor data

Now you’ll configure the Fingerprint Server SDK using your secret API key and use it to fetch detailed visitor data for each signup attempt. When making the initial visitor identification request in the front end, you received a requestId. This ID is unique to each identification event. Your server can then use the Fingerprint Events API and retrieve the complete identification data, including the trusted visitor ID and other actionable insights like whether they are using a VPN or are a bot.
  1. Create a .env file in your project root and add your secret API key:
.env
FINGERPRINT_API_KEY=your-secret-api-key-here
  1. At the top of your server.py file, import and initialize the fingerprint SDK:
server.py
import os
from dotenv import load_dotenv
import fingerprint_pro_server_api_sdk

# Load environment variables from .env file
load_dotenv()

# Get API key from environment variable
api_key = os.getenv("FINGERPRINT_API_KEY")
if not api_key:
    raise ValueError("FINGERPRINT_API_KEY environment variable is required")

# Initialize Fingerprint client with your Fingerprint workspace region
# Available regions: "us" (default), "eu", "ap"
configuration = fingerprint_pro_server_api_sdk.Configuration(api_key=api_key, region="eu")
client = fingerprint_pro_server_api_sdk.FingerprintApi(configuration)
  1. In your /api/create-account route, use the requestId you are sending from the front end to fetch the full visitor identification details:
server.py
@app.post("/api/create-account")
async def create_account(request: dict):
    # Get the full visitor identification details using the requestId
    event = client.get_event(request["requestId"])

    # Convert event to dictionary for easier access
    event_dict = event.to_dict() if hasattr(event, 'to_dict') else event.__dict__# ...
Using the requestId the Fingerprint server client will retrieve the full data for the visitor identification request. The returned object will contain the visitor ID, IP address, device and browser details, and Smart Signals like bot detection, incognito mode detection, and detections for VPN or virtual machine use. You can see a full example of the event structure, and test it with your own device, in our demo playground. For additional checks to ensure the validity of the data coming from your front end view how to protect from client-side tampering and replay attacks in our documentation.

​
4. Block bots and suspicious devices

This optional step uses the Bot Detection Smart Signal which is available only on paid plans.
A simple but powerful way to prevent fraudulent account creation is to block automated signups that come from bots. The event object includes the Bot Detection Smart Signal that flags automated activity, making it easy to reject bot traffic.
  1. Continuing in your /api/create-account route, check the bot signal returned in the event object:
server.py
# Check for bot activity
    bot_result = "unknown"
    if "botd" in event_dict["products"]:
        bot_data = event_dict["products"]["botd"]["data"]["bot"]
        bot_result = bot_data.get("result", "unknown")

        if bot_result != "notDetected":
		        print(f"BOT DETECTED: Bot result '{bot_result}' for visitor {visitor_id}")
            raise HTTPException(status_code=403, detail="Request blocked")
This signal returns good for known bots like search engines, bad for automation tools, headless browsers, or other signs of automation, and notDetected when no bot activity is found. You can also layer in other Smart Signals to catch more suspicious devices. For example, you can use Fingerprint’s Suspect Score to determine when to add additional friction to create an account.

​
5. Prevent multiple signups from the same device

To catch repeated signups from the same device, you can use the visitorId from the Fingerprint identification event. By saving this ID alongside each created account, you can easily detect and block duplicate signups. We’ll be using a simple database to demonstrate how this works with SQLite.
  1. At the top of your server.py file, import and initialize the database:
server.py
import sqlite3

# Initialize SQLite database
def init_database():
    conn = sqlite3.connect("database.db")
    cursor = conn.cursor()
    cursor.execute("""
        CREATE TABLE IF NOT EXISTS accounts (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            username TEXT,
            password TEXT,
            visitorId TEXT
        )
    """)
    conn.commit()
    conn.close()

# Initialize database on startup
init_database()
  1. In your /api/create-account route handler, after getting the event, extract the visitorId:
server.py
    # Extract visitor ID
    visitor_id = event_dict["products"]["identification"]["data"]["visitor_id"]
  1. Check if this device has already created an account; if yes, block the account creation:
server.py
  # Check if this device has already created an account
    conn = sqlite3.connect("database.db")
    cursor = conn.cursor()

    cursor.execute(
        "SELECT COUNT(*) as count FROM accounts WHERE visitorId = ?",
        (visitor_id,)
    )
    row = cursor.fetchone()

    if row[0] > 0:
        conn.close()
        print(f"DUPLICATE ACCOUNT: Visitor {visitor_id} already has an account")
        raise HTTPException(status_code=429, detail="Operation failed")

    # Otherwise, insert the new account
    cursor.execute(
        "INSERT INTO accounts (username, password, visitorId) VALUES (?, ?, ?)",
        (request["username"], request["password"], visitor_id)
    )
    conn.commit()
    conn.close()
This gives you a basic system to detect and block repeat signups. You can expand on this by allowing a limited number of accounts per device, adjusting your response based on business rules, only evaluating recent signups, etc.
This is a minimal example to show how to use the Fingerprint SDK. In a real application, make sure to implement proper security practices, especially around password handling and storage.

​
6. Test your implementation

Now that everything is set up, you can test the full flow using your existing front end.

​
Test the implementation

  1. Start your FastAPI server:
Terminal
python server.py
  1. In your front end, trigger a sign-up request that sends the requestId, username, and password to your /api/create-account endpoint. To see the reply messages make sure to parse and display or console log the response from your server.
  2. Within your front end, input a username and password to create a user. Then try to create another user and see that the second attempt will be rejected.
  3. Bonus: Try creating an account using a headless browser.

​
Next steps

You now have a working back-end fraud check using Fingerprint. From here, you can expand your logic with more Smart Signals, adjust thresholds based on your risk tolerance, or introduce additional checks for suspicious users. These same techniques apply to a wide range of fraud prevention use cases, from detecting fake reviews to blocking payment abuse or preventing account takeovers. To go further, check out our use case tutorials for step-by-step guides tailored to specific problems you can solve with Fingerprint. Check out these related resources: