Start in Observe on one route. Use the deployment URL and installed package version supplied for your workspace. Historical host examples and source capabilities do not establish a live service or published release.
Hosted verification at an enrolled boundary
Use hosted Gate authority for every protected browser action. Keep the site secret
and scoped API key in your platform secret manager. Do not write a local token
decoder or hand-built fetch that drops companion proof, raw target, response
updates or native complete-state metadata.
Warning
These examples describe the unpublished repository candidates. Node 0.4.0 is
vendored in the integration kit; npm 0.3.0 does not contain the candidate APIs.
The customer CLI, Go, Python, iOS, Android, Cloudflare and Vercel candidates are
not registry publication or customer deployment claims. Use the supplied kit or
reviewed checkout, and verify the package manifest before installation.
Cloudflare
Install the kit's package-cloudflare-worker/ candidate. It provides the
first-party collector proxy, hosted request validation and default-off Reroute
handler. Use the package's reviewed request helper/adapters with the original
Request and explicit HTTPS Gate origin. Preserve exact request bytes and request
proof; strip browser-supplied MANDATE/IP annotations and trust only platform
connection metadata. A local Worker test does not prove a deployed customer route.
Vercel
The kit's package-vercel-middleware/ is a customer-installed Observe sensor.
Install it with package-collector/, follow its Next.js middleware/proxy recipe,
and redeploy your application. Dashboard-saved production env configuration is
configured, not proof the deployment or route is active. The sensor continues
requests; use server-side hosted validation to enforce sensitive actions.
Reroute candidate
Reroute supports 1–8 explicitly enrolled actions per browser site. It combines
session-specific route locators, exact-body proof, hosted admission and a private
origin guard with intent/result reservation. Application authentication remains
required. Receiver/origin keys are private operator configuration, not SDK bundle
contents. Enrollment and readiness attestations do not prove runtime liveness.
Node Express/Next can declare reroute: true with explicit server-side bindings
and the optional Cloudflare public Reroute peer. The lane reuses the canonical
protocol and Gate's configured Verify/Limit admission; it never issues a second
managed charge. Missing peer/configuration fails closed. Express requires trusted
original raw Buffer bytes before JSON parsing; Next bounds a clone of the body.
Limit must be configured at Gate; trusted Subject comes from server authentication.
Defaults remain off. New admissions stop on disable; existing admitted attempts
retain their deadlines. Business requests are sent once and response loss is not
an instruction to retry. This is unpublished source/owned-test capability,
not provider deployment or customer rollout proof.
Credentials and rollout
Production browser credentials stay in an HttpOnly cookie. The repository
reader prefers _mndt and accepts legacy Mndt-Sess only when unambiguous;
the currently deployed writer uses Mndt-Sess. Match the live collector/Gate
configuration. Manual hosted helpers support credentialMode: "cookie" and
credentialCookieName: "Mndt-Sess" or "_mndt"; never rename a cookie without a
coordinated writer/reader rollout. Request proof uses x-md-vq, with legacy
x-mndt-req accepted. x-md-w, x-md-h and md_<seed> purpose cookies are
opaque, authenticated transport. Preserve SDK response updates and application
cookies. Do not copy credentials into page storage or logs.
Start Observe, inspect grouped evidence and false positives, and enforce one
reviewed route with rollback. Offline DEADMAN/legacy crypto is an explicit tier,
not automatic hosted-unavailability fallback. See Backend
and SDK overview.