Skip to main content

Server-only results

A public key lives in the survey page, so anything the toolbox gives the page can be read, and changed, by whoever loads it. Server-only results keep the result off the page: the page gets only the requestId, and your server reads the scores with a private key.

Turn it on when your server already makes the decision. The page then has no scores to read or change. It still carries the requestId: see What it does not do.

Who it is for​

Server-only results are a setting on a public key, so they only apply where a public key runs in the page. See Which key for each integration.

IntegrationServer-only resultsWhy
JavaScript routers and redirectsReadyThe page only passes the requestId on; your server reads the result.
React with your own endpointWhen it returns a decisionThe example endpoint returns the scores to the page. Return a decision instead: see Reading from your server.
Unicom, React without a server, or any page that reads results in the browserNot availableThese use a general key, which has no server-only results. Available once your server does the read: see Using a key pair.
AlchemerNo benefitPage 1 can use a public key with server-only results, but page 2 reads the full result in the browser with a general key.
DecipherNot availableDecipher uses a general key, and its terminations read survey variables that server-only results would leave empty.

What changes​

Without server-only results, identify gives the page the full result (shortened here):

{
  "requestId": "1729440000000.kXq3Lm",
  "participantId": "fGYzGGnKpwAfZc09byJy",
  "deviceScore": 87,
  "isDuplicate": false,
  "surveyId": "my-survey"
}

With server-only results, the page gets this and nothing else (the field keeps its API name, secureMode):

{
  "requestId": "1729440000000.kXq3Lm",
  "surveyId": "my-survey",
  "secureMode": true
}
  • getIdentity() resolves with that object.
  • getIdentityRequestId() already resolves with only { requestId }, so code that uses it doesn't change.
  • If the toolbox detects tampering, it still tells DQC, but it adds nothing to the page.
  • Your server reads the full result for that requestId with GET /tools/request/{requestId} and a private key.

Special responses are unchanged​

A special response describes a failure, not the respondent, and the page needs it to carry on. These come back whole, as they do without server-only results:

Handle them the way your page already does.

Turn it on​

Pages that use the scores stop getting them

Turning server-only results on takes the scores away from every page that uses the key, straight away. If any page still reads deviceScore or isDuplicate in the browser, move that page to the server read first, or give it a separate key.

  1. Set up the server read first, with a private key: Using a key pair.
  2. In the dashboard, go to Settings, then API keys, then the Public tab.
  3. Open the key's row menu and choose Turn on server-only results, then confirm.

The key's Results column changes from Sent to page to Server only. It takes effect on the next identify call, with nothing to redeploy.

Only public keys have server-only results. Private keys never reach a page, and general keys keep working the way they always have.

To turn it off, choose Turn off server-only results from the same menu. Pages get the full result again from the next identify call.

What it does not do​

  • It does not stop a requestId from being read more than once. Any server with your private key can read the same requestId again. Each lookup says whether it is the first: see Detect a reused requestId.
  • getIdentity() keeps the first result of a survey session, in both directions. A respondent who started before you turned it on keeps the full result, and one who started before you turned it off keeps the request ID only, until they start a new survey. getIdentityRequestId() asks again on every call, so it picks up the change straight away.
  • The toolbox can still show Wrapper Tampering before it knows the key's results are server-only. The first response tells it, so tampering detected before that response arrives comes back as the Wrapper Tampering special.
  • A copy of the toolbox you host yourself is not updated. Copies saved before server-only results existed can still add a score when they detect tampering. Load the toolbox from its URL, or refresh your copy, before you turn server-only results on.

Next steps​