Skip to main content
This guide connects one browser collection to one server-side verdict read. You need two active keys for the same site:
  • A public site key such as hrtc_live_0123456789abcdef01234567. Put it in browser code. It attributes a settled projection to the site, but it does not sign collection or authorize reads.
  • A secret verdict key such as hrtc_sk_0123456789abcdef0123456789abcdef. Keep it on your server. It reads projected verdicts attributed to that site.
Never place an hrtc_sk_... key in browser code, a public environment variable, or a client bundle.
1

Install the collector

2

Collect in the browser

heretic() resolves rather than rejecting into the host page:
The function starts one run per page. Later calls reuse the first run and its configuration.
3

Read the projection from your server

Configure the key only in your server environment:
4

Use immediate readiness

Successful ordinary collection returns a raw 32-character lowercase hexadecimal request ID after D1 acknowledges the tenant-visible projection. Your server can retrieve that ID immediately. Do not add a fixed polling delay.Missing, invalid, foreign, deleted, archived, pruned, and ZDR IDs share 404.
5

Use structured fields

Read Verdicts and coverage before interpreting the values. Do not parse human-readable prose fields.

Collector reference

Review every public option, endpoint resolution, CSP behavior, and ZDR.

Tenant verdict endpoint

Review authentication, status codes, timing, and response limits.

Related topics

Heretic documentation