Shield
Watch it verify you
This page runs a real Shield widget. By the time you read this sentence, you have probably already been verified — no puzzle, no clicking, no data collected.
The widget
A managed-mode widget in a typical signup form. The proof-of-work solved in a background thread while the page loaded — the badge is all a real visitor sees.
This form does not submit anywhere — it is here to show the widget in context.
The token
Verification produced a signed, single-use token and placed it in a hidden form input, ready to travel with the form submission. It expires after five minutes and refreshes automatically.
Waiting for verification…
Your humanity score
Decoded from the token payload — 1 is confirmed automation, 100 a confirmed human. Your application chooses what each range means: allow, step up, redirect, or block.
Keep moving your mouse or typing and watch it update: the first score is computed at page load, then refined once with a summary of how you actually interact. Human motor noise raises it — scripted precision lowers it.
Refresh the page and you're back at the baseline. That's not a bug — it's the privacy guarantee. Shield keeps no profile of you, so every visit starts as a fresh, anonymous assessment. A remembered "trusted visitor" would be a cookie to track you with and a credential for bots to farm; forgetting you is what makes the score honest.
Server-side validation
Your server POSTs the token to siteverify and gets the verdict plus the score. Try it —
then press the button again to watch the single-use protection reject the replay with
timeout-or-duplicate.
Managed mode
When traffic looks suspicious
You scored as a human, so verification stayed invisible. When a background attempt scores low, managed mode doesn't just block it — it asks for a single click and runs a harder proof-of-work behind it. Legitimate users tap once; scripted abuse pays a much steeper compute cost.
Press the button to see exactly what that escalation looks like — a real, harder challenge is issued and solved on your click.
Verification appears here once triggered.
Verified agents
When automation introduces itself
Not all automation is abuse — AI agents shop, book, and research for real people. Agents that sign their requests with Web Bot Auth (the IETF standard backed by OpenAI, Google, and Amazon) are cryptographically identified, so you can route them instead of fighting them. Automation that stays anonymous gets the aggressive treatment.
Press the button and Shield plays both sides for real: it signs a genuine agent request with an Ed25519 key published in its own key directory, then verifies that signature through the agentverify API — the exact flow a signed agent triggers on your site.
The signed request — three headers, verifiable identity
POST /agentverify — the verdict
Shield fetched the agent's public key from its published directory, checked the Ed25519 signature over the request, and confirmed who's calling — no user-agent trust, no IP allowlists. Run it again and a fresh single-use nonce is signed.
The entire integration
Everything you just saw took two lines on the page and one HTTP call on the server.
Your page
<script src="https://shield.edge.network/api.js" defer></script>
<div class="edge-shield" data-sitekey="es_your_sitekey"></div>Your server
POST https://shield.edge.network/siteverify
secret=es_secret_...&response=<token>