Quickstart

Keys

Create an account or sign in, then add a site under Sites & keys. Verify the domain using the DNS or file instructions on its panel. Copy the public site key for your page and issue a secret key for your backend. Copy the secret when it appears; it is shown only once.

Collector

Script tag
npm package

<script src="https://probe.heretic.tech/client.js"></script>
<script>
  heretic({ siteKey: 'hrtc_live_0123456789abcdef01234567' }).then((result) => {
    if (result.ok) fetch('/api/heretic', { method: 'POST', body: result.requestId });
  });
</script>

npm install https://probe.heretic.tech/collector-0.2.5.tgz

import { heretic } from '@heretic-hq/collector';

const result = await heretic({ siteKey: 'hrtc_live_0123456789abcdef01234567' });
if (result.ok) await fetch('/api/heretic', { method: 'POST', body: result.requestId });

result.requestId is a 32-character hex string. Send it to your server unchanged.

Read the verdict

const response = await fetch('https://heretic.tech/v1/verdict/' + requestId, {
  headers: { authorization: 'Bearer ' + process.env.HERETIC_SECRET_KEY },
  signal: AbortSignal.timeout(6000),
  redirect: 'error',
});
if (!response.ok) throw new Error('Heretic result unavailable');
const verdict = await response.json();

verdict.verdict;            // 'contradicted' | 'refused' | 'uncontradicted'
verdict.record.client_ip;   // address the probe arrived from
verdict.identity.machine;   // normalized hardware inputs
verdict.identity.instance;  // hardware and rendering inputs
verdict.identity.rendering; // optional stable rendering facet and its version

ok: true means collection completed. Read verdict.verdict on your server to learn the result. The signup rules guide covers attempt binding and account checks; the verdict schema describes the response fields. For a complete form and backend, follow the ten-minute plain HTML guide, Next.js guide, or SvelteKit guide. Node, Python and PHP clients cover each server API.

<script src="https://heretic.tech/guard.js" async defer></script>

<form action="/signup" method="POST">
  <div class="heretic-guard" data-sitekey="hrtc_live_0123456789abcdef01234567"></div>
  <button type="submit">Create account</button>
</form>

In its default mode, the widget returns a token for an uncontradicted probe. A contradicted or refused probe requires a phone challenge first. The token appears in the form’s hidden heretic-response field. Verify the token on your server:

curl https://heretic.tech/v1/siteverify \
  -H "content-type: application/json" \
  -d '{"secret":"hrtc_sk_your_secret_key","response":"<heretic-response>"}'

Require success === true before creating the account. Set expected_hostname, expected_action, and expected_cdata from your backend’s own session. Use policy: "challenge" if a ceremony is required. The response includes the original verdict and request_id, plus challenge_id and devices after a phone challenge. Fields and error codes are on the siteverify page.

Get started

Application integration

Collector

Challenge widget

Clearance

Frameworks and server clients

Understand Heretic

Reference

Manage and troubleshoot

Keys

Collector

Read the verdict

Challenge widget

​Keys

​Collector

​Read the verdict

​Challenge widget

Keys

Collector

Read the verdict

Challenge widget