From SDK install to bot blocked in less than 5ms.
CertiLayer runs entirely in the background. Real users never see a CAPTCHA. Bots never pass the check.
STEP 1
Install the SDK in 2 lines
Drop the SDK into your frontend. Behavioral capture starts immediately — no additional configuration.
npm install
npm install @certilayer/web — 5.5KB minified, zero dependencies, works with any framework.
init()
init({ apiKey: 'certilayer_live_pk_xxx' }) — one line in your root layout. That's it.
Trust Badge
showBadge() injects a Secured by CertiLayer badge — signals to users their session is protected.
STEP 2
Passive Signal Capture
The SDK silently captures 34 behavioral features. Every interaction builds a richer behavioral profile.
Completely invisible
No UI changes, no prompts, no friction. Real users never know CertiLayer is running.
Batched transmission
Signals batch every 5 seconds to ingest.certilayer.net. Bandwidth impact is negligible.
Cryptographically signed
All payloads are BLAKE3 signed. Replay attacks are blocked at the gateway before ML inference.
STEP 3
ML Inference in < 5ms
The L3 HCE Engine runs all 7 ONNX models and produces the Human Confidence Score.
M1 gates first
Rule-based fast rejection. Headless browser or missing touch API? Blocked before ML runs.
M2 identity check
BiLSTM compares the current behavioral embedding against the enrolled user profile.
M3 + M4 score
XGBoost classifier and Contrastive Autoencoders compute the final weighted HCS.
STEP 4
Verify on Your Backend
Send the session ID to your server. Verify with your secret key. Enforce based on verdict.
Server verification
GET /v1/session/:id with your secret key returns HCS score, verdict, and full breakdown.
Policy enforcement
Your backend decides: allow, tarpit, step-up, or terminate — based on your policy config.
Full dashboard visibility
Every session appears in your CertiLayer dashboard with score breakdown, timeline, and audit trail.