Quick Start

From zero to working bot detection in under 5 minutes.

Create a free account

No credit card. Free plan includes 1,000 sessions/month.

Get your API key pair

Dashboard → API Keys → Create key pair. You get a PUBLIC key for your frontend and a SECRET key for your backend. Save the secret — shown once.

Go to API Keys →

Install the SDK

5.5KB minified. Zero runtime dependencies.

typescript

npm install @certilayer/web

Initialize in your root layout

One call at startup. Use your PUBLIC key here — keep the returned instance, you'll need it for getSessionId().

typescript

// lib/certilayer.ts
import { init, showBadge } from '@certilayer/web'

export const certilayer = init({ apiKey: process.env.NEXT_PUBLIC_CERTILAYER_PK! })
showBadge({ position: 'bottom-right' })

Attach session ID to sensitive requests

Send it as a header when the user performs a critical action.

typescript

import { certilayer } from '@/lib/certilayer'

async function handleCheckout() {
  const sessionId = certilayer.getSessionId()
  await fetch('/api/checkout', {
    method: 'POST',
    headers: { 'X-CertiLayer-Session': sessionId },
    body: JSON.stringify(cart),
  })
}

Verify server-side

Always verify using your SECRET key on the backend — never trust the frontend score.

typescript

// app/api/checkout/route.ts
import { CertiLayerClient } from '@certilayer/node'

const certilayer = new CertiLayerClient({
  apiKey: process.env.CERTILAYER_SECRET_KEY!
})

export async function POST(req: Request) {
  const sessionId = req.headers.get('X-CertiLayer-Session')
  const { verdict } = await certilayer.verifySession(sessionId!)

  if (verdict === 'synthetic') {
    return Response.json({ error: 'bot_detected' }, { status: 403 })
  }
  return processCheckout(req)
}

✅

Done! Your app now passively detects bots on every session — no user friction, no CAPTCHAs.