Opaque browser tokens
The browser receives a cryptographically random token. Risk score and decision metadata stay server-side.
Invisible by design
Know who's human before they hit your backend.
Novera scores bot risk silently, returns one opaque token to the browser, and keeps the real decision inside an authenticated server-to-server verification.
No puzzles or interruptions No score exposed to JavaScript 90-second single-use tokens
server/verify.ts•••
const assessment = await novera.verify(token, {
expectedAction: "checkout"
});
// Only your backend receives this result
if (!assessment.success) deny();
if (assessment.score < 0.4) challenge();
Score0.91
RiskLow
DecisionAllow
Built for modern stacks
Next.jsLaravelDjangoExpressGoWordPress
Protection without friction
Strong signals. Quiet experience.
A layered, explainable risk engine looks for weak signals across behavior, velocity, network, and browser integrity—never one brittle check.
Explainable decisions
See useful factors like unusual velocity or short interaction time without exposing proprietary rule weights.
Action-aware policies
Tune login, signup, checkout, and custom actions independently with managed or custom thresholds.
Privacy-conscious telemetry
No typed values, form contents, passwords, or session replay. Only bounded, summarized interaction counters.
Replay-safe verification
Short-lived tokens are atomically consumed. A concurrent second verification is rejected every time.
Built for developers
A small async SDK, predictable test keys, typed server SDKs, and copy-paste integrations for every major stack.
A hard trust boundary
The browser never makes the decision.
An attacker can intercept JavaScript, change variables, or forge frontend responses. None of it changes the score stored by Novera or the result your backend receives.
✓Score is created and retained on Novera's server
✓Token is bound to project, hostname, action, and expiry
✓Secret key is accepted only by the verification API
✓Verification atomically consumes the token
01Browser SDKSummarizes privacy-safe signalsUNTRUSTED
02Assessment APIStores risk result, returns cap_… onlyNOVERA
03Your backendSends token + secret key to /v1/siteverifyTRUSTED
04Policy decisionAllow, monitor, challenge, or blockSERVER