Getting Started
VeilProof is an invisible bot-detection layer: a browser SDK collects behavioral signals, your customer's server decides who to trust — not the browser. Three steps to integrate:
1. Get keys
Create a project in the dashboard — you get a site key (browser) and a secret key (server), always as a pair.
2. Drop in the script
Add one script tag (or npm install) with your site key. No JS required for plain HTML forms.
3. Verify server-side
Your server redeems the token with your secret key at /api/siteverify before trusting the request.
Site key vs. secret key
Never put your secret key in browser code. The site key (
vp_site_...) is public — it's meant to sit in your HTML/JS. The secret key (vp_secret_...) only ever runs on your server, to call /api/siteverify. The SDK refuses to initialize with a secret key.Quick start
html
<script src="https://cdn.jsdelivr.net/npm/veilproof@1.1.0/dist/veilproof.min.js"
data-site-key="{{ VEILPROOF_SITE_KEY }}"
async defer></script>
<!-- Render data-site-key from your server-side template/config (Django, EJS, Blade, WordPress option, etc.) — don't hardcode it in a committed HTML file. -->