Node.js

Start in Observe on one route. Use the deployment URL and installed package version supplied for your workspace. Historical host examples and source capabilities do not establish a live service or published release.

Install the unpublished candidate

npm install /absolute/path/to/mandate-integration-kit-v0.4.0/package

Requires Node18+ for the hosted SDK; the enrolled Reroute lane requires Node20+

and the optional Cloudflare peer. Keep site secret/API key server-only and set

an explicit HTTPS gateUrl or MANDATE_GATE_URL.

Express hosted validation

import { mandateHosted } from "@mandate-security/node/express";
app.post("/api/checkout", mandateHosted({
  siteSecret: process.env.MANDATE_SITE_SECRET,
  siteKey: process.env.MANDATE_SITE_KEY,
  apiKey: process.env.MANDATE_API_KEY,
  gateUrl: process.env.MANDATE_GATE_URL,
  credentialMode: "cookie", credentialCookieName: "Mndt-Sess",
  highValue: true, origin: "https://app.example.com", mode: "observe",
}), checkoutHandler);

Start Observe, inspect grouped Activity and false positives, then set this route

to enforce. Application authentication/authorization remains yours.

validateHostedRequest(request, options) is the low-level manual helper;

withMandateHosted(handler, options) is the Next.js App Router adapter. Hosted

scores remain null. Adapters preserve authenticated response cookies/companions

and native rotation state before enforcing the documented HTTP outcome.

Production browser credentials stay in an HttpOnly cookie. The repository

reader prefers _mndt and accepts legacy Mndt-Sess only when unambiguous;

the currently deployed writer uses Mndt-Sess. Match the live collector/Gate

configuration. Manual hosted helpers support credentialMode: "cookie" and

credentialCookieName: "Mndt-Sess" or "_mndt"; never rename a cookie without a

coordinated writer/reader rollout. Request proof uses x-md-vq, with legacy

x-mndt-req accepted. x-md-w, x-md-h and md_<seed> purpose cookies are

opaque, authenticated transport. Preserve SDK response updates and application

cookies. Do not copy credentials into page storage or logs.

One-call managed wrappers

import { mandateManagedMiddleware } from "@mandate-security/node/express";
app.post("/api/checkout", mandateManagedMiddleware({
  verify: true,
  limit: true,
  subject: req => req.user.id, // supplied by prior server authentication
}), checkoutHandler);

Use the CLI-preset application/environment connection or explicit advanced

siteKey/siteSecret/apiKey/gateUrl. Verify defaults true; Limit requires configured

Gate budget and trusted Subject when its key is subject. This single decision

must not be followed by another validation/charge. Next uses

withMandateManaged(handler, options) and trusted Subject from server auth.

Off and valid unmatched routes proceed; unavailable or malformed authority is

1. Observe proceeds without claiming verified trust. Limit denial returns 429

without origin execution. Private response updates are not included in public

onDecision/context metadata.

Native workflow effects remain Observe by default. Enforced policy results

require enrolled, independently reviewed F2/F3 interpretation authority, exact

profile/release binding and explicit Gate runtime enablement. The Node server

helper may sign original captured request bytes, but cannot approve a catalog or

grant policy authority. Denied/challenge return coarse 403 and preserve updates;

no CAPTCHA or automatic business retry is introduced.

Enrolled Reroute

reroute: true requires explicit server bindings and the public optional

@mandate-security/cloudflare-connector/reroute peer. Defaults remain off;

missing peer/configuration fails closed. Supports 1–8 enrolled browser actions,

shared Gate Verify/Limit admission and trusted account Subject. Express accepts

only bounded original raw Buffer bytes; Next reads a bounded clone. Private

origin keys are never browser input. See Edge verification.

Explicit offline APIs

verifyMandateToken, verifyRequest, createVerifier and the legacy local

adapters remain available for bounded legacy/test use. They do not establish

live replay, revocation or session trust and are not normal protected browser

authority. DEADMAN uses its dedicated scoped offline reader and incident window;

never silently substitute local crypto when a hosted call is unavailable.

See Backend integration for response handling and

High-value routes for rollout.