Update to Fingerprint

{
  "name": "fingerprint-request-filtering",
  "description": "Protect your public Fingerprint API key from unauthorized use by configuring request filtering — allowed origins, header restrictions, and block lists — so the key only works from your own apps even though it's visible in client source. Use when securing the public key, preventing key abuse, or setting up allow/block lists.",
  "included_files": [
    {
      "relative_path": "skill.json",
      "size_in_bytes": 270
    }
  ],
  "skill_md_contents": "---\nname: fingerprint-request-filtering\ndescription: Protect your public Fingerprint API key from unauthorized use by configuring request filtering — allowed origins, header restrictions, and block lists — so the key only works from your own apps even though it's visible in client source. Use when securing the public key, preventing key abuse, or setting up allow/block lists.\n---\n\n# Fingerprint — Protect your public API key (request filtering)\n\nMaps to the dashboard **\"Protect your public API key\"** Get Started step. The public API key ships\nin your client source, so anyone can read it. Request filtering rules make the key only usable\nfrom **your** apps, so a copied key can't rack up usage or pollute your data elsewhere.\n\nThis is configured in the dashboard against the environment's public key — there is no code change\nbeyond keeping the agent's origin consistent.\n\n## Set up request filtering (dashboard)\n1. In the dashboard, go to **Security → Web**.\n2. Under **Websites**, click **Configure** and set an **allowlist** of the exact origins your app\n   loads the agent from (e.g. `https://app.yourdomain.com`, plus `http://localhost:3000` for local\n   dev). Requests from other origins are rejected. (Use a blocklist instead to deny specific origins.)\n3. Optionally, under **Forbidden HTTP Headers**, click **Add rule** to restrict by header.\n4. Save and test: a request from an allowed origin succeeds; one from an unlisted origin is blocked.\n   Rule changes can take up to ~5 minutes to take effect.\n\n## How to apply\n1. **Enumerate every origin** that legitimately loads the agent: production domain(s), any preview\n   domains, and local dev. Read these from the project (e.g. deployment config, `vite.config`,\n   `next.config`, CORS settings) so the allowlist matches reality and you don't lock out prod.\n2. **Add them in the dashboard** — this step has no SDK call.\n3. If you also use a **custom subdomain / proxy** (`fingerprint-proxy-integration`), make sure the\n   allowed origins still match where the page is served from.\n4. Don't over-restrict: missing a real origin silently breaks identification there. Verify each\n   listed app still identifies after enabling the rules.\n\n## Best practices\n- Treat the public key as public — request filtering is the control, not secrecy.\n- Keep the allowlist in sync as you add domains/preview environments.\n- Never try to \"hide\" the public key in code; it's meant to be in the browser. The **secret** key\n  is the one that must never reach the client.\n- Pair with the Rules Engine (`fingerprint-rules-engine`) for signal-based blocking on top of\n  origin-based filtering.\n"
}