Authentication

CertiLayer uses public/secret key pairs. One for your frontend SDK, one for your backend server.

Key types

Public key

certilayer_live_pk_xxx...Frontend / SDK / Browser / Mobilesafe

Secret key

certilayer_live_sk_xxx...Backend server only — never in browsersecret

U0001f6ab

Never put your secret key (certilayer_live_sk_) in browser code, mobile apps, or version control. It has full API access.

ℹ️

A separate test/sandbox key type isn't available yet — every key created today is a live key. See Environments for how to point your integration at a local or self-hosted instance instead.

Frontend — public key

typescript

import { init } from '@certilayer/web'

init({ apiKey: process.env.NEXT_PUBLIC_CERTILAYER_PK! })
// certilayer_live_pk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Backend — secret key

Node.js

import { CertiLayerClient } from '@certilayer/node'

const certilayer = new CertiLayerClient({
  apiKey: process.env.CERTILAYER_SECRET_KEY!, // certilayer_live_sk_...
})

const result = await certilayer.verifySession(sessionId)
if (result.verdict === 'synthetic') {
  return res.status(403).json({ error: 'bot_detected' })
}

Python

from certilayer import CertiLayerClient

client = CertiLayerClient(api_key=os.environ["CERTILAYER_SECRET_KEY"])
result = await client.verify_session(session_id)
if result.verdict.value == "synthetic":
    raise HTTPException(403, "bot_detected")

ℹ️

Create your key pair in Dashboard → API Keys. The secret key is shown only once — save it immediately.