Start in Observe on one route. Use the deployment URL and installed package version supplied for your workspace. Historical host examples and source capabilities do not establish a live service or published release.
Hosted verification is the default
MANDATE SDKs connect your protected server route to live Gate authority. Hosted
verification cross-references browser/session proof, route and origin binding,
lineage and replay state. Apply it to every protected browser action. Local
crypto is restricted to the explicit DEADMAN incident tier and bounded legacy
compatibility; it cannot consume a copied credential globally.
Warning
These examples describe the unpublished repository candidates. Node 0.4.0 is
vendored in the integration kit; npm 0.3.0 does not contain the candidate APIs.
The customer CLI, Go, Python, iOS, Android, Cloudflare and Vercel candidates are
not registry publication or customer deployment claims. Use the supplied kit or
reviewed checkout, and verify the package manifest before installation.
| Surface | Repository candidate | Installation/status |
|---|---|---|
| Node | @mandate-security/node 0.4.0 | Vendored kit package/; unpublished candidate |
| Customer CLI | @mandate-security/cli 0.1.0 | Kit package-cli/ or sdks/cli; unpublished |
| Go | github.com/mandate-security/mandate-go | sdks/go; local replacement or reviewed archive |
| Python | mandate-python 0.1.0 | sdks/python; source, wheel and sdist candidates; no PyPI release |
| iOS | MandateMobile | Swift package and XCFramework build pipeline; unpublished |
| Android | dev.mandate.mobile | Java library and Android AAR build pipeline; unpublished |
| Cloudflare | @mandate-security/cloudflare-connector 0.3.0 | Kit source; collector, hosted admission and enrolled Reroute |
| Vercel | @mandate-security/vercel-middleware | Kit source; customer-installed Observe sensor |
| Ruby, PHP, .NET, Rust, Java server | Planned APIs | No usable server SDK release; use a supported hosted service |
Android mobile JCA code does not implement the planned Java server verifier.
A authored binary build pipeline is not a successful AAR/XCFramework build or
real vendor/device proof. Native app attestation, refresh and rotation require
matching Gate registration, platform credentials and strict atomic state adoption.
Server adapters
Node provides Express and Next.js hosted and managed wrappers. Go provides
net/http; Python provides Flask and FastAPI. Managed wrappers perform one
canonical decision call for v1 Verify and v2 Limit, with a server-authenticated
Subject callback when required. They preserve authenticated session/purpose
cookies, request companions and native complete-state updates. Missing or
ambiguous native state fails closed; business actions are never retried.
Managed defaults are Observe. Off and valid unmatched routes proceed; missing,
invalid or unavailable configuration is an error. Observe proceed does not
prove verification or authenticate a user. The commissioned interpretation lane is currently Node/F3; Go/Python ordinary
managed wrappers do not expose profile-signing options. Native policy enforcement requires
separately enrolled, independently reviewed F2/F3 authority and explicit runtime
enablement; ordinary integrations cannot grant that authority themselves.
Credential configuration
Production browser credentials stay in an HttpOnly cookie. The repository
reader prefers _mndt and accepts legacy Mndt-Sess only when unambiguous;
the currently deployed writer uses Mndt-Sess. Match the live collector/Gate
configuration. Manual hosted helpers support credentialMode: "cookie" and
credentialCookieName: "Mndt-Sess" or "_mndt"; never rename a cookie without a
coordinated writer/reader rollout. Request proof uses x-md-vq, with legacy
x-mndt-req accepted. x-md-w, x-md-h and md_<seed> purpose cookies are
opaque, authenticated transport. Preserve SDK response updates and application
cookies. Do not copy credentials into page storage or logs.
Install a reviewed candidate
MANDATE_KIT_DIR=/absolute/path/to/mandate-integration-kit-v0.4.0
npm install "$MANDATE_KIT_DIR/package"
npm install -g "$MANDATE_KIT_DIR/package-cli"See Quickstart, Node, Go,
Python, and CLI. Keep your site secret and scoped API
key on the server. Locked `POST /validate`
requires tokens:validate; the managed operation also requires the enrolled
application/environment scope. High-value checks fail closed on unavailable authority.