Glossary
Visit token
An opaque value connecting the browser’s token request to a later signup check. It is not a persistent visitor identity.
In Signup Protection, the browser obtains a token when the registration form becomes visible, after applicable consent. Your code calls visitToken.fetch(vid), writes the returned string into a form field and passes it to your server. The public page key belongs in the browser; the secret API key stays on the server.
Use an opaque, visit-scoped value for vid. Do not send an email address, phone number or account ID. Neither the token nor vid establishes that a visitor is a unique person. A new token does not establish that a new account belongs to somebody new.
A missing or unusable token gives signals.status: token_unusable. When email would otherwise allow, this requires mailbox confirmation. An unavailable signals service is a different outcome: the combined action follows email alone. Neither means that the visit passed every check.
For a transport retry, retain the original request and Idempotency-Key. Presenting the same token in a new operation can produce fp_token_reused. Follow the browser and server integration guide and read the resulting signup check.