Works with your stack.
A script tag in the browser, one HTTP call from your backend. No DNS changes, no proxy, no agents — Botect drops into whatever you already run.
Two pieces, side by side.
The SDK runs in the visitor’s browser and posts behavioral signals — mouse, scroll, visibility, keyboard cadence — to ingest. It groups them into a session and never collects PII.
Your backend reads the verdict for a session with your private key — cached, <50ms p99, fails open. You decide what to do with block, challenge, or allow.
Two snippets to live.
<script
src="https://cdn.botect.ai/v1/sdk.js"
data-site-key="pk_live_8f2a…"
async
></script>curl https://api.botect.ai/v1/sessions/$TOKEN/verdict \
-H "Authorization: Bearer sk_live_…"
# { "score": 12, "band": "definite",
# "action": "block", "verified_bot": null }If it serves HTML, it works.
There’s no framework lock-in. The SDK is a standard script tag and the verdict is plain REST — so Botect rides along with whatever you already run.
A site key and ten minutes.
Two keys
A public site key for the browser SDK and a secret private key for server-side verdict reads. Generate and rotate both from your dashboard.
One script tag
Add the SDK to the pages you want scored. It starts collecting behavioral signals immediately — no build step, no config.
One HTTP call
Read the verdict from your backend over plain REST. Any language, any framework — if it can make an HTTPS request, it works.
Nothing else
No DNS changes, no reverse proxy, no agent to install. Botect sits beside your app, never in front of it.
Drop in the SDK in ten minutes.
Grab your keys, add a script tag, read one verdict — and watch real scores against your own traffic before you enforce anything.