JavaScript API

AgentGate.init, execute, render, getResponse, reset and remove, their options and results, and the error codes execute() rejects with.

The SDK defines one global, window.AgentGate.

init(options)

AgentGate.init({ siteKey: "site_…", endpoint: "https://agentgate.example" });

Call it as early as possible: it starts document-wide interaction counters (key and pointer timings, never what is typed) that the check scores. It may be called more than once; later calls only change siteKey and endpoint. Declarative widgets call it for you.

execute(options)

Runs a verification and resolves with a token. Use it for requests your code sends itself.

try {
  const { token, expiresAt, decisionId } = await AgentGate.execute({ action: "signup" });
  await fetch("/api/signup", { method: "POST", headers: { "X-AgentGate-Token": token }, body });
} catch (err) {
  if (err instanceof AgentGate.Error) console.warn(err.code, err.status);
}

The result:

Call execute() just before sending the request, not at page load: the token is short-lived and single use.

Errors

execute() rejects, and errorCallback receives, an AgentGate.Error with a stable code (and status, the HTTP status, when the server answered):

AgentGate.errors lists every code. The server-side meaning of each is on Error codes.

render(element, options)

Creates a widget in element (an element or a CSS selector) and returns its id. Options and callbacks are on Widget configuration. Rendering into an element that already holds a widget replaces it.

getResponse(id)

The widget's current token, or "" when it has none (not verified yet, consumed by a submission, or expired).

reset(id)

Cancels a verification in progress (without calling errorCallback), clears the token and returns the widget to its first state: the "Protected" chip, and the Verify button in interactive mode.

remove(id)

Cancels a verification in progress, then takes back everything the widget added: its submit handler, the agentgate_token field it created (a field your page provides is kept), its elements, timers and the attributes it set on the host. The form then submits as if AgentGate had never rendered there. Call it from your framework's unmount or cleanup hook.

id can be the id render() returned, the host element, or omitted (the most recently rendered widget). An id that no longer exists does nothing.