Script tag

<script src="https://probe.heretic.tech/client.js"></script>
<script>
  heretic({ siteKey: 'hrtc_live_0123456789abcdef01234567' }).then(async (result) => {
    if (!result.ok) return;
    await fetch('/api/heretic', { method: 'POST', body: result.requestId });
  });
</script>

The script defines a global heretic function. It runs once per page; later calls return the same run. result.requestId is a 32-character hex string. When ok is true, your backend can read the result immediately at GET /v1/verdict. See collector results for incomplete runs. Verify the site’s domain in the dashboard before running the collector. The public site key works on that domain and its subdomains, and in Heretic-hosted widget frames. Reading results requires a secret key on your server. The TCP and per-session QUIC names require the wildcard in connect-src below.

Content security policy

script-src https://probe.heretic.tech 'wasm-unsafe-eval';
connect-src https://probe.heretic.tech https://*.waw.probe.heretic.tech;
worker-src blob:;

To serve the bundle from your own origin, use dist/heretic.js from the npm package and name your origin in script-src. Options and result lists every heretic(config) option and the result shape.

Get started

Application integration

Collector

Challenge widget

Clearance

Frameworks and server clients

Understand Heretic

Reference

Manage and troubleshoot

Content security policy

​Content security policy

Content security policy