Overview
MANDATE protects high-value web actions from replay, token theft, and scripted browser abuse without CAPTCHAs.
It is designed for browser-originated actions such as sign-in, account creation and checkout, and adds browser and request-integrity evidence to your server’s decision. It is not a general WAF, CDN, DDoS service or payment-fraud scoring system.
How verification works
- Connect the browser. A supported integration loads browser collection for your application. The core flow runs invisibly, without a checkbox or puzzle.
- Carry short-lived proof. The integration carries an opaque credential with the protected request. It is not a JWT or a customer-readable summary of browser characteristics.
- Ask the hosted service. Your server submits the proof through its server-side integration. Hosted verification cross-references live state, including replay and session continuity.
- Complete the application decision. Your application applies its authentication, authorization, business rules and supported verification policy. Observe-only integrations record evidence without claiming enforcement.
The full lifecycle is on How Verify works.
Capabilities and availability
| Capability | What it does | Status |
|---|---|---|
| Verify | Browser verification for sign-in, account creation, checkout and other high-value actions. | Managed SDK preview. Native Verify workflows currently observe. |
| Limit | Action budgets for verified browsers or authenticated server identities, with Observe, explicit Enforce and Pause. | Implemented in the Node managed integration candidate. Package publication and production activation are separate steps. |
| Policy Studio | Route inventory, policy drafts and deliberate releases for browser-action protection. | Beta, with the managed SDK preview. |
| EdgeD | Browser collection and verification in a supported edge request path: a Cloudflare Worker or Vercel middleware. | Provider preview, not generally available. The Cloudflare Worker has historical staging evidence; current lifecycle changes need fresh validation. The Vercel middleware is observe-only and has not completed live provider validation. EdgeD Managed is planned, not available. |
| Reroute | Scoped request paths for an existing protected action, designed to reconcile retries with stored outcomes. | In development. Implemented locally and default-off; runtime and release validation are pending. Not a published SDK or customer deployment path. |
Integration
The managed SDK preview covers Next.js App Router and Express through @mandate-security/node, set up with @mandate-security/cli. The packages are not yet published to their registries; your dashboard supplies the matching install command.
Start with one browser-originated action. Keep webhooks, OAuth callbacks, machine APIs and scheduled jobs outside browser verification, with the authentication each of them needs. The quickstart walks through one route.
Proof, evidence and data
- Proof: short-lived and opaque, carried with the protected request. Not a JWT.
- Verification: hosted and server-side, cross-referencing live state, including replay and session continuity.
- Local verification: an emergency fallback or legacy compatibility path. It does not replace the current context used by hosted verification.
- Reporting: grouped evidence. Customer reporting does not expose raw browser fingerprints, behavior traces or private detection internals.
- Privacy: the privacy policy is a review draft. Deployment-specific processing terms and notices need to match the actual integration.
What MANDATE does not do
- It does not establish that a person is human. Real browsers can be automated.
- It does not replace authentication, authorization or business validation in your application.
- It is not a WAF, CDN, DDoS service or payment-fraud scoring system.
- No accuracy, false-positive or latency figures are claimed.
Public beta
MANDATE is in public beta. The public beta is provided at no cost and on a best-effort basis. MANDATE offers no public uptime guarantee or service-credit program. Any commitment must be in a separate signed agreement.
Company and contact
MANDATE is built by MANDATE Security Inc., a Delaware corporation. Write to hello@mandate.so, or find MANDATE on X, LinkedIn, GitHub and Bluesky. More on the About page.