Token Verification

Start in Observe on one route. Use the deployment URL and installed package version supplied for your workspace. Historical host examples and source capabilities do not establish a live service or published release.

Hosted verification

Credentials are opaque pointers to live Gate state. Keep their bytes private and

use hosted verification for protected browser actions. The server forwards the

original request and authenticated companion context; Gate checks live session,

route/origin, lineage, replay markers and counters. No browser-visible CAPTCHA

or puzzle is required.

import { validateHostedRequest } from "@mandate-security/node";

const result = await validateHostedRequest(request, {
  siteSecret: process.env.MANDATE_SITE_SECRET,
  siteKey: process.env.MANDATE_SITE_KEY,
  apiKey: process.env.MANDATE_API_KEY,
  gateUrl: process.env.MANDATE_GATE_URL,
  credentialMode: "cookie",
  credentialCookieName: "Mndt-Sess",
  highValue: true,
  origin: "https://app.example.com",
});
if (!result.success) return new Response("Forbidden", { status: 403 });

Prefer framework adapters when response-cookie, companion and native-state

updates must be applied. A manual boolean check alone is insufficient to rotate

those updates. Hosted scores remain internal; human is a legacy alias, not

human identity. High-value unavailable authority stays denied.

Production browser credentials stay in an HttpOnly cookie. The repository

reader prefers _mndt and accepts legacy Mndt-Sess only when unambiguous;

the currently deployed writer uses Mndt-Sess. Match the live collector/Gate

configuration. Manual hosted helpers support credentialMode: "cookie" and

credentialCookieName: "Mndt-Sess" or "_mndt"; never rename a cookie without a

coordinated writer/reader rollout. Request proof uses x-md-vq, with legacy

x-mndt-req accepted. x-md-w, x-md-h and md_<seed> purpose cookies are

opaque, authenticated transport. Preserve SDK response updates and application

cookies. Do not copy credentials into page storage or logs.

Local verification: explicit incident or legacy mode

verifyMandateToken and compatible Go/Python crypto helpers still exist for

bounded legacy integrations and tests. They make no Gate call and cannot check

live revocation, global replay consumption or session trust. They are not the

normal protected browser path. DEADMAN is the separately scoped, short-lived

Emergency offline tier; use its dedicated reader and exact window/domain/route

binding rather than silently falling back from a hosted error.

Credential expiry depends on the route and protocol. Ordinary refreshed tokens

may have a 15-minute TTL; sensitive route refreshes use shorter lifetimes.

Expiry alone does not establish replay safety.

Recovery

Return documented coarse public errors and honor Retry-After. Missing or stale

proof may require fresh background verification. Do not expose detector-specific

reasons, parse opaque proof or retry business actions automatically. See

Errors and High-value routes.