Quickstart

1. Create a siteCopy Anchor Link

In the dashboard, choose New site, name it, and list the hostnames it runs on (add localhost to test locally). Copy the sitekey and the secret; the secret is shown once.

2. Add the widget to your formCopy Anchor Link

<script src="https://api.example.com/v1/api.js" async defer></script>

<form method="post" action="/signup">
  <input name="email" type="email" required />
  <div class="botbar-widget" data-sitekey="site_..." data-action="signup"></div>
  <button>Sign up</button>
</form>

The widget adds a hidden botbar-response field to the form when the visitor passes.

3. Verify the token on your serverCopy Anchor Link

curl https://api.example.com/v1/siteverify \
  -d secret=$BOTBAR_SECRET \
  -d response=$TOKEN_FROM_THE_FORM

{ "success": true, "hostname": "example.com", "action": "signup", "score": 0.9, "error-codes": [] }

Reject the form unless success is true, hostname is yours and action is the one you set. The server libraries do those checks for you.

4. Tune itCopy Anchor Link

Watch the site's traffic in the dashboard, then move between security levels or set per-action rules.