Script tag

<script src="https://probe.heretic.tech/client.js"></script>
<script>
  heretic({ siteKey: 'hrtc_live_0123456789abcdef01234567' }).then(async (result) => {
    if (!result.ok) return;
    await fetch('/api/heretic', { method: 'POST', body: result.requestId });
  });
</script>

The script defines a global heretic function. It runs once per page; later calls return the same run. result.requestId is a 32-character hex string. It is readable at GET /v1/verdict as soon as the promise resolves. The site key is public. It attributes the session to a site and reads nothing.

Content security policy

script-src https://probe.heretic.tech 'wasm-unsafe-eval';
connect-src https://probe.heretic.tech;
worker-src blob:;

To serve the bundle from your own origin, use dist/heretic.js from the npm package and name your origin in script-src. Options and result lists every heretic(config) option and the result shape.

Get started

Collector

Challenge widget

Understand Heretic

Reference

Manage and troubleshoot

Content security policy

​Content security policy

Content security policy