Skip to main content

​
Overview

When Stytch returns an BLOCK verdict, it is because this device has automation or spoofing that is undesirable. You should block the privileged action.

​
Block verdicts in the API

When you receive a BLOCK verdict in the Fingerprint Lookup response, we recommend blocking the request associated with that Telemetry ID from proceeding. Stytch returns a verdict.reasons array in the Fingerprint Lookup response that will indicate the reason for the BLOCK verdict. For example, the following response indicates that the request received a BLOCK verdict because it uses browser automation tooling and a deceptive user agent: 
"verdict": {
	"action": "BLOCK",
	"detected_device_type": "UNKNOWN",
	"is_authentic_device": false,
	"reasons": ["USER_AGENT_DECEPTION", "HEADLESS_BROWSER_AUTOMATION"]
}
If you maintain your own risk score based on cumulative Device Fingerprinting verdicts, we recommend assigning a high level of risk to a BLOCK verdict. You may also choose to assign different risk scores to different verdict reasons.
See Reference guides for a full list of possible verdict reasons.

​
Block verdicts in Protected Auth

When Protected Auth is enabled in Enforcement mode and a BLOCK verdict is returned, the Stytch SDK will always prevent the user’s request from proceeding.

​
Unblocking a device or device group

If you’d like to unblock a device or group of devices that’s receiving an BLOCK verdict, you can set a rule to ALLOW that traffic.