Screenshot attribution is not an authentication feature. It is a rendered-surface feature that depends on trustworthy identity, a correctly loaded SDK and enough protected signal surviving in the submitted image.

Treating it as an engineering system—not a script pasted five minutes before launch—produces better attribution and fewer operational surprises.

Choose the Web App boundary

Create one ExactMark Web App for a coherent authenticated application or security boundary. Configure the allowed origins precisely. Avoid broad wildcards that permit the property key to run on unrelated hosts.

If staging and production have materially different users or data, separate them. This keeps test sessions out of production evidence searches and makes status easier to interpret.

Load the SDK on protected pages

Place the loader on pages rendered after authentication:

<script src="https://exactmark.com/sdk.js"
  data-property="YOUR_PROPERTY_KEY"></script>

The loader address and property key are public configuration, not authentication secrets. Signing secrets, by contrast, belong only on your server.

Ensure your content security policy permits the loader and required network requests. Test changes in the same browser conditions your users encounter, including strict tracking protection and corporate filtering where relevant.

Create a private viewer reference

Create a stable, cryptographically random reference for each account and keep the reference-to-account mapping in your own database. Do not derive it from a name, email address, username, sequential database ID or other identifying value.

Call exactmark.identify only after your backend has authenticated the account and issued a matching token:

exactmark.identify(viewerReference, {
  viewerToken
});

Do not generate a new reference on every page load, and do not share one reference across several people. ExactMark does not accept personal viewer details or page paths. Handle account and tenant switching only after authentication state has settled.

Sign every attribution-ready reference

Browser-supplied identity can be manipulated by someone with control of the page. ExactMark therefore requires a valid short-lived server-signed token before a Web Session can be used for attribution. Unsigned activity may remain visible only as integration telemetry when strict rejection is disabled.

Generate the token only after your backend has authenticated the account. Sign only the token version, opaque viewer reference, Web App key and expiry. Keep the signing secret outside the client bundle, source maps and public environment variables; use a short expiry and rotate a disclosed secret promptly.

The valid token proves that the customer's server approved that opaque reference for the Web App. Only the customer can connect the reference to the account it recognised.

Verify observability without content capture

ExactMark should receive only the opaque viewer reference and minimal operational session metadata—not the private page body or a viewer profile. Confirm that Web Sessions show the expected reference and Web App without a name, email address, raw account ID or page path.

Use the connection-testing flow with a controlled account. An “installed” label based only on historical sessions would be ambiguous, so verify first and last detection and deliberately open the protected route during testing.

Test evidence, not merely network requests

A successful SDK request proves transport, not recovery. Complete an end-to-end test:

  1. Open the app as a controlled viewer.
  2. Confirm the Web Session appears.
  3. Take a representative screenshot.
  4. Crop or recompress a copy if those transformations reflect the real threat model.
  5. Submit each artifact to Evidence Lab.
  6. Check the expected session, confidence and separation.

Test flat interfaces, charts, photographs and dense text separately. Signal strength and recoverability vary with content and transformations.

Operationalise the integration

Document ownership for the property key, signing secret, allowed origins and evidence workflow. Include ExactMark checks in authentication or frontend release testing. Give developers installation access without automatically exposing sensitive evidence.

Finally, establish how results will be reviewed. Confidence-scored attribution is a technical finding that should be combined with server logs, account security and chain-of-custody information. The engineering objective is not an infallible label; it is a trustworthy signal with enough context to support a responsible investigation.