Introduction

Start in Observe on one route. Use the deployment URL and installed package version supplied for your workspace. Historical host examples and source capabilities do not establish a live service or published release.

What is MANDATE?

MANDATE is a background browser-verification platform for protected routes. It scores browser-session evidence, issues a server-side credential, and lets your backend enforce route decisions without showing users a challenge.

MANDATE is in public beta.

Trusted sessions continue without visible challenge UI. Suspicious sessions receive stricter route decisions based on grouped evidence.

How It Works (High Level)

1. A lightweight script loads on your page from gate.x-lock.dev
2. The script performs invisible background verification
3. Production deployments issue a short-lived HttpOnly Mndt-Sess cookie through a first-party collector path on your origin
4. Your backend verifies the request with live Gate authority using that cookie. Locked hosted `POST /validate` is the normal protected browser-action check

Core Concepts

Cookie-first session

Production browser routes use the server-issued HttpOnly Mndt-Sess credential. Serve collector traffic through a first-party path so the cookie is set for your domain, not only gate.x-lock.dev. The page does not receive raw token material to inspect. The credential is short-lived (15-minute TTL) and remains a bounded bearer credential: HttpOnly limits direct page-script reads, but does not make copied cookies or compromised same-origin scripts replay-proof.

Hosted validation

Locked `POST /validate` is the default server-to-server check. It requires a tokens:validate API key and is the path for high-value, replay-sensitive, or unsupported-runtime routes. Hosted validation returns decision fields and refreshed-token metadata; raw scores stay internal.

Compatibility header verification

Local X-Mndt header verification remains available for non-production compatibility, SDK tests, and emergency offline use. Use it only for explicit DEADMAN or bounded legacy compatibility, not the normal protected browser path.

Scoring

Compatible local verification can expose a bounded risk score from 0.0 (higher risk) to 1.0 (lower risk). The score summarizes browser-session evidence; it does not identify a definite bot or prove a human operator. You decide your route thresholds.

Actions

Based on the score, MANDATE recommends one of three actions:

Next Steps