NeuroGuard Docs

Quick Start

1. Create a site in the dashboard and copy its public siteKey.
2. Add the CDN widget before the closing body tag.
3. Verify the generated neuroguard_token and neuroguard_session on your backend before accepting writes.

<script
  src="https://cdn.neuroguard.pro/shield.js"
  data-site-key="ng_pk_YOUR_SITE_KEY"
  data-endpoint="https://api.neuroguard.pro/api/v1/token"
  data-auto="true"
  async>
</script>

<form method="POST" action="/contact">
  <input name="email" type="email" required>
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>

Server Verification

Browser telemetry is not trusted. The backend must verify the single-use token through api.neuroguard.pro before processing forms, orders, registrations, or other mutations.

const response = await fetch("https://api.neuroguard.pro/api/v1/verify", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    siteKey: "ng_pk_YOUR_SITE_KEY",
    secretKey: "ng_sk_YOUR_SECRET_KEY",
    token: formData.get("neuroguard_token"),
    sessionId: formData.get("neuroguard_session"),
    userAgent: request.headers.get("user-agent") || "",
    ip: clientIp,
  }),
});

const result = await response.json();
if (!result.valid || result.decision !== "allow" || result.label !== "HUMAN") {
  return new Response("Blocked", { status: 403 });
}

SPA Usage

For React, Vue, or custom AJAX flows, call window.NeuroGuard.getToken() manually and send the token to your own backend.

const result = await window.NeuroGuard.getToken("ng_pk_YOUR_SITE_KEY");
if (!result.token) throw new Error(result.error || "verification failed");

await fetch("/api/contact", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ message, neuroguardToken: result.token }),
});

API Endpoints

Production Domains

Security Rules

• Never accept a form submission only because the widget ran in the browser.
• Always verify neuroguard_token and neuroguard_session server-side.
• Block by default when the token is missing, expired, invalid, already consumed, or not HUMAN.
• Keep secretKey only on your backend.
• Use HTTPS for the protected site, widget CDN, and API verification.