Skip to content

Add tracking_token documentation for explicit device linking#1589

Merged
horgh merged 3 commits intomainfrom
greg/eng-4045
Feb 25, 2026
Merged

Add tracking_token documentation for explicit device linking#1589
horgh merged 3 commits intomainfrom
greg/eng-4045

Conversation

@oschwald
Copy link
Member

Summary

  • Add tracking_token to Device request schema in API docs
  • Add TRACKING_TOKEN_INVALID and TRACKING_TOKEN_NOT_FOUND warning codes to response docs
  • Expand device tracking page with explicit device linking section

ENG-4045

Test plan

  • Hugo builds successfully
  • cspell lint passes
  • Schema rows follow existing format patterns
  • Warning codes in alphabetical order

🤖 Generated with Claude Code

@gemini-code-assist
Copy link
Contributor

Summary of Changes

Hello @oschwald, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces and documents the tracking_token feature, which enables more robust and high-confidence device matching within the minFraud service. By allowing users to explicitly link devices using a token rather than solely relying on IP addresses, the system can overcome limitations posed by shared or dynamic IP environments. The changes ensure that developers have clear guidance on how to integrate this new capability into their applications, enhancing the accuracy of fraud detection.

Highlights

  • API Documentation Update: The tracking_token field has been added to the Device request schema in the API documentation, providing a new mechanism for explicit device linking.
  • New Warning Codes: Two new warning codes, TRACKING_TOKEN_INVALID and TRACKING_TOKEN_NOT_FOUND, have been introduced to the response documentation to indicate issues with the provided tracking token.
  • Enhanced Device Tracking Guide: The device tracking page has been significantly expanded with a dedicated section on 'Explicit device linking', detailing its benefits, implementation steps, and best practices.
Changelog
  • content/minfraud/api-documentation/requests.md
    • Added tracking_token to the example JSON for device requests.
    • Included a new schema row detailing the tracking_token input, its purpose, and linking to further documentation.
  • content/minfraud/api-documentation/responses.md
    • Inserted TRACKING_TOKEN_INVALID and TRACKING_TOKEN_NOT_FOUND warning codes into the response documentation table.
  • content/minfraud/track-devices.md
    • Updated existing trackDevice() JavaScript examples to demonstrate capturing and logging the trackingToken.
    • Added a comprehensive new section titled 'Explicit device linking', explaining its functionality, implementation steps for web (module and npm), token handling guidelines, Content Security Policy requirements, custom hostname configuration, and mobile SDK support.
  • stopwords.txt
    • Added 'CGNAT' to the list of stopwords.
Activity
  • No human activity has been recorded on this pull request since its creation.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Feb 23, 2026

Deploying dev-site with  Cloudflare Pages  Cloudflare Pages

Latest commit: 8ad7ecd
Status: ✅  Deploy successful!
Preview URL: https://1ad0d98c.dev-site-4ua.pages.dev
Branch Preview URL: https://greg-eng-4045.dev-site-4ua.pages.dev

View logs

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

The pull request introduces documentation for the tracking_token feature, including its addition to the device request schema, new warning codes, and an expanded device tracking page with an explicit device linking section. The changes generally improve clarity and provide necessary information for users to implement this new feature. All original comments have been retained as they align with general best practices for documentation and do not contradict the provided rules. I've focused on ensuring grammatical correctness, consistency in terminology, and adherence to the specified documentation style guide, particularly regarding articles, punctuation, and brand names. I've also identified an opportunity to improve the clarity of a sentence for better readability.

{{</minfraud-schema-row>}}

{{< minfraud-schema-row key="tracking_token" type="request" valueType="string" valueTypeNote="max length: 255" >}}
The token returned by the [Device Tracking Add-On](/minfraud/track-devices) `trackDevice()` function, used for explicit device linking. When provided, this token enables high-confidence device matching that does not rely on IP address alone.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This sentence could be rephrased for better clarity. The current phrasing is a bit clunky. Consider simplifying it to improve readability.

Suggested change
The token returned by the [Device Tracking Add-On](/minfraud/track-devices) `trackDevice()` function, used for explicit device linking. When provided, this token enables high-confidence device matching that does not rely on IP address alone.
The token returned by the [Device Tracking Add-On](/minfraud/track-devices) `trackDevice()` function, used for explicit device linking. When provided, this token enables high-confidence device matching that does not rely solely on IP address.


### Mobile SDKs

The Android and iOS SDKs also support the tracking token feature for explicit
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The word "tracking token" should be formatted as inline code using backticks for consistency with other technical terms in the documentation. This aligns with the style guide's recommendation for inline code formatting.

Suggested change
The Android and iOS SDKs also support the tracking token feature for explicit
The Android and iOS SDKs also support the `tracking token` feature for explicit
References
  1. Format field names as code when referenced in prose: ipv4_32 (not plain text ipv4_32). (link)

@oschwald oschwald force-pushed the greg/eng-4045 branch 3 times, most recently from 4f4449f to f9ea5ee Compare February 24, 2026 16:37
Update API request/response docs and expand the device tracking
page with explicit device linking guidance and examples.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
})
)
.then(({ trackingToken }) => {
// Store the tracking token to include in your minFraud API request
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if here and the below example should say something like it's optional to do this.

- `script-src`: `device.maxmind.com`
- `connect-src`: `d-ipv4.mmapiws.com`, `d-ipv6.mmapiws.com`

### Custom hostname
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be outside the explicit device linking section? i.e. ## maybe.

- Tokens should be treated as **transient**. Generate a fresh token for each
session or transaction rather than storing tokens long-term.

### Content Security Policy (CSP) requirements
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this section too?


## Explicit device linking

By default, the minFraud service matches devices using IP address. This works
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"using IP addresses" maybe? It reads a bit odd to me.

- **VPNs** where multiple users route traffic through the same VPN endpoint.

Explicit device linking solves this by using a `tracking_token` to match devices
with high confidence, independent of IP address.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"of the IP address" perhaps?

| `SHIPPING_POSTAL_NOT_FOUND` | The shipping postal code could not be found in our database. This may impact our ability to provide accurate distance calculations. |
| `SHIPPING_REGION_NOT_FOUND` | The shipping region could not be found in our database. This may impact our ability to provide accurate distance calculations. |
| `TRACKING_TOKEN_INVALID` | The tracking token provided was invalid or malformed. |
| `TRACKING_TOKEN_NOT_FOUND` | The tracking token provided was not found on our system. |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"in our system" maybe?

oschwald and others added 2 commits February 25, 2026 13:25
Address PR review feedback: add notes that tracking token capture is
optional, pluralize "IP addresses", add article "the IP address", and
fix "in our system" preposition.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
These sections apply to device tracking generally, not just explicit
device linking, so they should be ## sections rather than ### subsections.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@horgh horgh merged commit e2673a0 into main Feb 25, 2026
10 checks passed
@horgh horgh deleted the greg/eng-4045 branch February 25, 2026 21:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants