Quickstart

Start in Observe on one route. Use the deployment URL and installed package version supplied for your workspace. Historical host examples and source capabilities do not establish a live service or published release.

Protect one browser action

Create an app and verified domain in the dashboard.

Keep the public site key in the browser; the site secret and scoped API key stay

on your server. Start the route in Observe, review Activity and false positives,

then enable one route with a rollback plan.

Install the vendored SDK and CLI

MANDATE_KIT_DIR=/absolute/path/to/mandate-integration-kit-v0.4.0
npm install "$MANDATE_KIT_DIR/package"
npm install -g "$MANDATE_KIT_DIR/package-cli"
mandate init --target . --mode observe --agent --write
mandate doctor

The one-time dashboard install link writes credential/configuration handoff

files into your application repository; it does not install a globally published

CLI. Use only the dashboard-generated link, keep it private, and never construct

install URLs containing site secrets.

Serve the collector first-party

Serve the reviewed collector recipe through your app origin so HttpOnly

credentials belong to your domain. Install package-collector/ from the kit and

follow Frontend integration. A direct script URL alone

does not establish a first-party collector or complete deployment.

<script async src="https://gate.x-lock.dev/g.js?k=YOUR_SITE_KEY"></script>

Validate on the server

// app/api/checkout/route.ts — Node Next.js App Router
import { withMandateHosted } from "@mandate-security/node/next";

export const POST = withMandateHosted(
  async (_request, { mandate }) => {
    // Authenticate the user and execute checkout in your own handler.
    return Response.json({ ok: true, sessionId: mandate.sessionId });
  },
  {
    siteSecret: process.env.MANDATE_SITE_SECRET,
    siteKey: process.env.MANDATE_SITE_KEY,
    apiKey: process.env.MANDATE_API_KEY,
    gateUrl: process.env.MANDATE_GATE_URL,
    credentialMode: "cookie",
    credentialCookieName: "Mndt-Sess", // match the deployed writer
    highValue: true,
    origin: "https://app.example.com",
    mode: "observe",
  },
);

Set an explicit HTTPS Gate endpoint; the candidate does not infer a public host.

The adapter forwards the original method/target and companion proof and applies

authenticated response updates. Observe records the decision and lets the handler

run; it does not establish verified trust. After reviewing real route traffic,

change this route to mode: "enforce"; invalid or unavailable validation then

refuses the protected handler. Keep application authentication and authorization.

Production browser credentials stay in an HttpOnly cookie. The repository

reader prefers _mndt and accepts legacy Mndt-Sess only when unambiguous;

the currently deployed writer uses Mndt-Sess. Match the live collector/Gate

configuration. Manual hosted helpers support credentialMode: "cookie" and

credentialCookieName: "Mndt-Sess" or "_mndt"; never rename a cookie without a

coordinated writer/reader rollout. Request proof uses x-md-vq, with legacy

x-mndt-req accepted. x-md-w, x-md-h and md_<seed> purpose cookies are

opaque, authenticated transport. Preserve SDK response updates and application

cookies. Do not copy credentials into page storage or logs.

Verify the rollout

Load the page, confirm collection reaches your origin, and submit the protected

route once. Inspect grouped Activity/Signals and any false positives. Offline

unit checks do not create Activity or prove customer integration. See

High-value routes and

Backend integration for hosted/managed adapters.