Shield

Getting Started

Three steps: create a widget, embed it, validate tokens. Most integrations take under five minutes.

1. Create a Widget

In the control panel, go to Shield → Create Widget. Give it a name, optionally restrict it to your hostnames, and choose a mode (Managed is recommended — see Widget Modes).

You'll receive two keys:

Key	Format	Where it lives
Sitekey	`es_…`	Public — embedded in your pages
Secret key	`es_secret_…`	Server-side only — shown once at creation

The secret key is stored hashed and cannot be displayed again. If you lose it, revoke the widget and create a new one.

2. Add the Widget to Your Page

Include the script once, and place a div.edge-shield inside any form you want to protect:

<script src="https://shield.edge.network/api.js" defer></script>

<form action="/signup" method="POST">
  <input type="email" name="email" required />
  <div class="edge-shield" data-sitekey="es_your_sitekey"></div>
  <button type="submit">Sign up</button>
</form>

The widget verifies the visitor and appends a hidden edge-shield-response input to the form. Tokens auto-refresh before they expire, so slow form-fillers aren't penalised. The bundle is under 15KB and solves its challenge in a Web Worker.

3. Validate the Token on Your Server

When the form is submitted, POST the token and your secret key to siteverify:

curl -X POST https://shield.edge.network/siteverify \
  -d "secret=es_secret_..." \
  -d "response=<edge-shield-response from the form>"

Response:

{
  "success": true,
  "score": 92,
  "challenge_ts": "2026-07-21T08:00:00.000Z",
  "hostname": "example.com",
  "error-codes": []
}

A complete server-side example:

// Express example
app.post('/signup', async (req, res) => {
  const token = req.body['edge-shield-response']

  const result = await fetch('https://shield.edge.network/siteverify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      secret: process.env.SHIELD_SECRET,
      response: token,
    }),
  }).then(r => r.json())

  if (!result.success) {
    return res.status(400).send('Verification failed')
  }
  if (result.score < 40) {
    return res.status(403).send('Blocked') // or redirect automation to your API
  }

  // ... create the account
})

Always validate server-side

The hidden input can be forged by an attacker — only a successful siteverify call proves the token is genuine, unexpired, and unused. Tokens are single-use: a second siteverify call with the same token returns timeout-or-duplicate.

Next Steps

Widget Modes

Choose how visible verification is

Server-Side Validation

Error codes and using the score