The semiconductor industry has adopted a horizontal business model wherein one company designs the Integrated Circuits (ICs), a second company fabricates them and a third one tests and packages them. Separating design from fabrication introduces vulnerabilities in the IC supply chain. An offshore semiconductor foundry can overproduce FPGAs, and a malicious distributor can reinsert old, recycled and counterfeit FPGAs into the supply chain. We present an approach to fingerprint FPGAs by leveraging process variations and spatial correlations. We confirmed FPGA fingerprinting on 56 Xilinx Artix-7 FPGAs.