Quick start
TrueSift separates the visible browser verification from the authoritative server-side decision. A manipulated frontend therefore cannot authorize a protected action by reporting its own status.
Basic flow
Browser / form
→ request challenge
→ perform browser verification
→ receive short-lived verificationToken
→ send protected business request
→ verify token server-side against expected context
→ execute action only after a valid proofSite Key and Secret Key
The Site Key identifies the TrueSift integration. The Secret Key belongs exclusively on the server and must never be exposed in browser configuration, HTML, or client-side JavaScript.
Browser result
The browser component displays the interaction state and returns the verificationToken. Values such as allowed, decision, score, status, action, path, or origin sent by the browser are not trusted authorization.
Server proof
The protected server route verifies the token against the expected context. Login, registration, form submission, checkout, or another business action is executed only after the authoritative server-side verification allows it.