Quickstart

By the end of this page you will have a visit on the dashboard and a server-side check that can refuse a request.

1. Get the site's keys#

Open API keys on the dashboard. Every site has two keys, and they are not interchangeable:

• Public key (pk_live_…): lives in your page source, and being visible is fine. What protects it is the origin allowlist, not secrecy.
• Secret (sk_live_…): server-side only. It is shown once at creation; rotate it if lost.

Declare the origins your pages are served from at the same time. The collector refuses a visit arriving from an origin that is not on the list.

2. Add the SDK#

One tag, at the end of <body> on every page you want covered. There is no npm package, the tag is the whole browser integration.

<script src="https://hideguard.io/sdk/v1.js"
        data-site-key="pk_live_..."></script>

data-block="true" shows the built-in interstitial when the verdict is block. It is off by default: a script that can black out a customer's page the moment it is installed is a script nobody should install.

Every attribute is listed in Browser SDK.

3. Read the verdict on the page#

window.addEventListener("fpc:verdict", (event) => {
  const { verdict, score, visitorId, requestId } = event.detail;
  console.log(verdict, score);
});

This verdict is information, not a gate. It arrives after the page was served, it is drawn by JavaScript, and a client that runs no JavaScript never meets it.

4. Ask from your server#

This is the half that can refuse. Call it where something of value changes hands: checkout, login, password reset, coupon redemption.

curl -X POST https://hideguard.io/api/v1/verdict \
  -H 'x-api-key: sk_live_...' \
  -H 'content-type: application/json' \
  -d '{"visitorId":"<fpc_vid cookie>","ip":"<client ip>","userAgent":"<user-agent header>"}'

5. Check it worked#

Load your page, then open Identification on the dashboard. The visit appears within a few seconds. Open it to see every measurement behind the score.

If nothing arrives, look at Health: it counts every answer ingest gave, including the ones refused for a bad key or a disallowed origin.