Integrate account-sharing detection at login and protected access

Integrating account-sharing detection requires a trusted association between the authenticated account, observed device activity and the protected action. Collect evidence through the provider’s supported client integration, verify results on the server and evaluate them with the account’s current entitlement.

Login is an important checkpoint, but it may not cover a long-lived subscription session. Identify which later resource access or account events need checks, and define pending, missing and delayed-result behavior before enforcing a policy.

Map the trust boundary

The browser can collect observations and carry an event or token reference. It should not be able to choose the authoritative account, manufacture a risk result or claim an entitlement by sending arbitrary fields.

Derive the authenticated account from the application’s trusted session. Associate the provider reference through the documented contract. Use the supported server verification or retrieval interface and protect credentials server-side. The exact SDK call and result fields differ by vendor; use its current documentation rather than adapting an unrelated example.

Use stable account references

Choose an internal account or user reference that remains consistent across visits. Keep organization and seat relationships separate. A random session ID cannot replace a stable user association when a sharing rule needs to count distinct devices over time.

Test account switching. When two legitimate users use one shared browser, a new login must associate subsequent events with the correct account while leaving earlier history intact. Logout should clear inappropriate application state without pretending the physical device disappeared.

cside’s sharing documentation explicitly requires a stable userId for its account-device window. Its current activation restrictions and manual rule activation must also be resolved before a new integration is planned.

Handle the result lifecycle

A missing result, a pending result and a completed low-risk result are different states. Decide how each affects the particular action. An information page may tolerate a different fallback from granting a valuable entitlement or changing account security settings.

Record a correlation reference so a late response can be matched to the original action. Use idempotency for webhooks or retries. If the user has switched accounts, the later result still belongs to the original authenticated attempt; it should not silently attach to whoever is now using the browser.

Avoid publishing sensitive detection reasons to an untrusted client. Customer-facing messages should explain the available recovery action, while authorized support sees the evidence required to investigate the case.

Instrument relevant access after login

List the resources whose use matters: playback, paid exports, licensed actions or sensitive account operations. Choose supported access events that reveal actual use without generating unnecessary billable checks for every background asset.

Castle’s tutorial explains that login-only tracking can miss activity in long-lived sessions. Rupt Access Protection documents evaluation at protected access. Confirm equivalent coverage for native apps, direct API clients and other supported surfaces instead of assuming a web snippet observes them all.

Connect detection with entitlement and response

ShieldLabs combines ready-made Account Sharing with live identity and network context, risk scores and named signals. Associate the known account through the documented integration and receive results through its API and webhooks. Compare the event with current permitted use and define the application’s recovery journey.

A configurable policy product may require the team to set windows and thresholds. An identity layer may require account history and sharing logic in the application. Keep those implementation responsibilities visible in the procurement comparison: the same integration budget can buy very different amounts of completed workflow.

Keep an investigation record

Record the account reference, entitlement version, provider event reference, timestamps, relevant identity relationships, named finding and executed response. Include a correction or reversal reference when support resolves a mistaken restriction.

Minimize stored personal and location data, restrict access and define retention. Do not log API secrets, passwords or full customer payloads merely to simplify debugging. A useful investigation record connects evidence to a decision without turning ordinary logs into an uncontrolled identity database.

Run a release checklist

Test legitimate multi-device access, known sharing simulations, account switching, stale entitlements, collection failure, server verification failure and delayed results. Confirm the customer can recover after a mistaken device restriction and that a corrected entitlement reaches the next access check.

Measure decision timing before the protected action, not just endpoint response time in isolation. Estimate the production call volume for login, access and retries. See the false-positive and recovery guide for evaluating the customer outcome after the integration works technically.

FAQ

Sources and further reading

Read October 21, 2026: ShieldLabs documentation, Fingerprint developer documentation, Castle account-sharing tutorial, Rupt Access Protection, cside sharing integration. Compare evaluation routes.