AUTHENTICATED POST-DEPLOYMENT CONTROL
Every request signed. Every signature verified. Bots blocked. DevTools detected.
That is the system.
Scrapers, credential stuffers, and automation scripts send requests indistinguishable from users. Without attestation, all requests are treated equally.
API endpoints are publicly reachable. A cURL command bypasses the frontend entirely. Rate limits and paywalls become suggestions.
Captured requests are replayed. Without timestamps in the signature, stale requests remain valid indefinitely.
Parameters are modified in transit. Without integrity checks, modified payloads are indistinguishable from original requests.
No dependencies. No modifications. The script handles the rest.
One line of code. That is all.
<script src="https://sekyuriti.build/api/v2/attest/script/att_xxx"></script>Requests without valid attestation are rejected. No exceptions.
Real users pass through.
Everything else is noise.
<script src="https://sekyuriti.build/api/v2/attest/script/att_xxx"></script>// In your API handler (Node.js example)
const headers = request.headers;
const verification = await fetch(
"https://sekyuriti.build/api/v2/attest/verify",
{
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
project_id: process.env.ATTEST_PROJECT_ID,
api_key: process.env.ATTEST_API_KEY,
method: request.method,
url: request.url,
timestamp: headers["x-attest-timestamp"],
signature: headers["x-attest-signature"],
fingerprint: headers["x-attest-fingerprint"],
}),
}
);
const { attested, reason } = await verification.json();
if (!attested) {
return new Response(
JSON.stringify({ error: "Request not attested" }),
{ status: 401 }
);
}
// Continue with your API logic...All plans include request signing and bot detection. Billing resets monthly.
One script tag. One API call. Zero bots.