Loading NeuroGuard…
Integrate NeuroGuard anti-bot protection into any system.
1. Sign up at the dashboard and create a site to get your siteKey and secretKey.
2. Add the widget to your frontend (one script tag).
3. Call /api/v1/verify from your backend to verify token + widget session.
<script
src="https://cdn.neuroguard.pro/shield.js"
data-site-key="ng_pk_YOUR_KEY"
data-endpoint="https://api.neuroguard.pro/api/v1/token"
data-auto="true"
defer>
</script><?php
class NeuroGuard {
private string $siteKey;
private string $secretKey;
private string $apiUrl = "https://api.neuroguard.pro";
public function __construct(string $siteKey, string $secretKey) {
$this->siteKey = $siteKey;
$this->secretKey = $secretKey;
}
public function verify(string $token, string $sessionId): array {
$payload = json_encode([
'siteKey' => $this->siteKey, 'secretKey' => $this->secretKey,
'token' => $token,
'sessionId' => $sessionId,
'userAgent' => $_SERVER['HTTP_USER_AGENT'] ?? '',
'ip' => $_SERVER['REMOTE_ADDR'] ?? '',
]);
$ch = curl_init($this->apiUrl . '/api/v1/verify');
curl_setopt_array($ch, [CURLOPT_POST => true, CURLOPT_POSTFIELDS => $payload,
CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 10]);
$response = curl_exec($ch); curl_close($ch);
return json_decode($response, true) ?? ['valid' => false];
}
public function protect(): bool {
if (!empty($_POST['website_url'])) return false;
$token = $_POST['neuroguard_token'] ?? '';
$sessionId = $_POST['neuroguard_session'] ?? '';
if ($token && $sessionId) {
$result = $this->verify($token, $sessionId);
return $result['valid'] && $result['decision'] === 'allow' && $result['label'] === 'HUMAN';
}
return false; // Default-deny: no token = block
}
}
$ng = new NeuroGuard('ng_pk_YOUR_KEY', 'ng_sk_YOUR_SECRET');
if (!$ng->protect()) { http_response_code(403); die('Access denied'); }import requests
class NeuroGuard:
def __init__(self, site_key, secret_key, api_url="https://api.neuroguard.pro"):
self.site_key = site_key
self.secret_key = secret_key
self.api_url = api_url
def verify(self, token, session_id, user_agent="", ip=""):
resp = requests.post(f"{self.api_url}/api/v1/verify", json={
"siteKey": self.site_key, "secretKey": self.secret_key,
"token": token, "sessionId": session_id, "userAgent": user_agent, "ip": ip,
}, timeout=10)
return resp.json()
def protect(self, token="", session_id="", honeypot=False, user_agent="", ip=""):
if honeypot: return False
if token and session_id:
result = self.verify(token, session_id, user_agent, ip)
return result.get("valid") and result.get("decision") == "allow" and result.get("label") == "HUMAN"
return False
# Flask usage
# ng = NeuroGuard("ng_pk_KEY", "ng_sk_SECRET")
# @app.route("/contact", methods=["POST"])
# def contact():
# if not ng.protect(token=request.form.get("neuroguard_token",""),
# session_id=request.form.get("neuroguard_session",""),
# honeypot=bool(request.form.get("website_url")),
# user_agent=request.headers.get("User-Agent",""),
# ip=request.remote_addr):
# return "Blocked", 403export class NeuroGuard {
constructor(private siteKey: string, private secretKey: string,
private apiUrl = "https://api.neuroguard.pro") {}
async verify(token: string, sessionId: string, userAgent: string, ip: string) {
const res = await fetch(`${this.apiUrl}/api/v1/verify`, {
method: "POST", headers: { "Content-Type": "application/json" },
body: JSON.stringify({ siteKey: this.siteKey, secretKey: this.secretKey, token, sessionId, userAgent, ip }),
});
return res.json();
}
async protect(params: { token?: string; sessionId?: string; honeypotFilled?: boolean; userAgent: string; ip: string }) {
if (params.honeypotFilled) return false;
if (params.token && params.sessionId) {
const result = await this.verify(params.token, params.sessionId, params.userAgent, params.ip);
return result.valid && result.decision === "allow" && result.label === "HUMAN";
}
return false;
}
}| Endpoint | Method | Description |
|---|---|---|
| /api/v1/session | POST | Issue widget session and one-time nonce |
| /api/v1/token | POST | Consume nonce and issue verification token (widget calls this) |
| /api/v1/verify | POST | Verify token server-to-server |
| /api/v1/challenge | GET/POST | Generate / validate cognitive challenge |
| /api/v1/captcha/verify | POST | Verify third-party captcha token |
| /api/v1/shield-js | GET | Serve latest or ?version=v1.3.0 widget script (first-party hosting) |
| /api/v1/status | GET | Public API status |
| /api/v1/openapi-spec | GET | OpenAPI 3.0 specification |
| /api/health | GET | Detailed health check |
if (honeypot_filled) → BLOCK
if (has_token) → verify(token) → if !valid → BLOCK
if (!has_token) → BLOCK (default-deny)
// Never accept without verificationNeuroGuard v1.0 · Home · Swagger · CMS Guides