GET /g.js

Start in Observe on one route. Use the deployment URL and installed package version supplied for your workspace. Historical host examples and source capabilities do not establish a live service or published release.

Endpoint

GET https://gate.x-lock.dev/g.js?k={site_key}

Description

Serves the MANDATE verification script. This script handles the entire verification flow automatically:

1. Performs background verification
2. Establishes an opaque encrypted credential on success
3. Presents that credential automatically on subsequent same-origin requests

(production uses the HttpOnly Mndt-Sess cookie; header modes are

non-production compatibility paths)

Query Parameters

Response

Content-Type: application/javascript

Cache-Control: private, no-store, no-cache

The response is valid JavaScript that self-executes. It should be loaded via a <script> tag:

<script async src="https://gate.x-lock.dev/g.js?k=sk_live_..."></script>

Behavior

• The script executes immediately on load
• Verification runs in the background with no user interaction
• On success, subsequent same-origin fetch() and XMLHttpRequest calls from

the page automatically carry the verification credential

Error Handling

Example

<!DOCTYPE html>
<html>
<head>
  <script async src="https://gate.x-lock.dev/g.js?k=sk_live_..."></script>
</head>
<body>
  <!-- Your page content -->
  <!-- Production same-origin protected requests carry Mndt-Sess automatically -->
</body>
</html>