Plain HTML / CSS / JS

No build step, no framework, no npm required. Drop one script tag into any static site, WordPress theme, or server-rendered page and CertiLayer starts scoring sessions immediately.

1. Add the script tag

Place this right before the closing </body> tag on every page you want protected. Use your PUBLIC key — it's safe to expose in page source.

index.html

<script src="https://cdn.jsdelivr.net/npm/@certilayer/web/dist/certilayer.min.js"></script>
<script>
  var certilayer = CertiLayer.init({
    apiKey: 'certilayer_live_pk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
  });

  // Optional: show the "Secured by CertiLayer" badge
  CertiLayer.showBadge({ position: 'bottom-right' });
</script>

U0001f6ab

Only ever use your PUBLIC key (certilayer_live_pk_...) here — this script runs in the visitor's browser and anyone can view-source it. Never paste your secret key (certilayer_live_sk_...) into a <script> tag.

2. Capture starts automatically

CertiLayer.init() starts capture internally — there's nothing else to wire up. CertiLayer immediately begins passively observing typing rhythm, mouse movement, scroll, and page navigation, and flushes a batch to the ingestion gateway every few seconds.

3. Attach the session ID to a form or critical request

init() returns the SDK instance — keep the certilayer variable from step 1 around so you can call getSessionId() when the user does something sensitive, like submitting a form.

Plain HTML form

<form id="signup-form" method="POST" action="/signup">
  <input type="email" name="email" required>
  <input type="hidden" name="certilayer_session" id="cl-session">
  <button type="submit">Sign up</button>
</form>

<script>
  document.getElementById('signup-form').addEventListener('submit', function () {
    document.getElementById('cl-session').value = certilayer.getSessionId();
  });
</script>

4. Verify on your server

Same as every other SDK — verification always happens server-side, using your SECRET key. Use the Node.js SDK or Python SDK if your backend runs on either, or call the REST API directly from any other language.

curl — any backend language

curl https://api.certilayer.net/v1/session/<the_session_id> \
  -H "X-API-Key: certilayer_live_sk_xxx"

ℹ️

Never call this endpoint from the browser — it requires your SECRET key. Only your backend should verify sessions.

5. WordPress / other server-rendered sites

Paste the same script tag from step 1 into your theme's footer template (footer.php), or the "Footer Scripts" field most page builders and site builders provide — no plugin required.

Authentication→HCS Score→Protect Login→