Noxtica Documentation

Use these docs to move from an activated account to a measured, reviewable policy. Noxtica provides browser and device intelligence, calibrated risk, bot and agent controls, and operator workflows; your team chooses where those outputs influence a customer journey.

Availability is account-specific. Backoffice visibility, API scopes, module status, and your service agreement determine which surfaces you can use. A capability described in the directory may still require entitlement, tenant or domain activation, a supported client, or privacy/legal review.

Choose a path by task

What is Noxtica?

Noxtica collects eligible browser, device, network, and interaction context, checks the available evidence for consistency, and returns a calibrated assessment. A result can help you recognize a returning browser installation, identify suspicious automation or infrastructure, verify supported agent identities, prioritize an investigation, or apply a route-specific policy.

The result is not proof that a visitor is a particular person, a guaranteed bot verdict, or a replacement for authentication. Read risk, confidence, and reasons together and combine them with the value and reversibility of the action your application is considering.

Key Capabilities

• Device and browser intelligence: receive a tenant-scoped device handle and a calibrated assessment from an activated collector.
• Bot, abuse, and network defense: combine automation, consistency, infrastructure, and interaction reason families without making one signal decisive.
• Risk and decisioning: use score, five-level risk tier, confidence, and reasons in customer-owned allow, observe, challenge, review, or block policies.
• Agent identity and control: apply separate trust policies to supported signed agents and unknown automation when the module is enabled.
• Investigation and operations: review device records, trends, policy outcomes, audit history, alerts, and eligible exports in Backoffice.
• Integrations: consume browser events, scoped backend reads, SDKs, event delivery, exports, and eligible read-only MCP access.

See the Customer Capability Reference for every public family, where it appears, what it produces, and what must be enabled.

Platform Components

Quick Start

1. Get Your Site Key

Request access through Contact. After your account is provisioned, sign in to Backoffice, add the exact production or staging origin under Domains, and copy its Site Key. Keep environments separate; a Site Key is public but origin-bound.

2. Add the Collector

Copy your domain’s snippet from Backoffice → Integrations & API → Script & Consent, then follow the install walkthrough. It is the single source for the core and extensions scripts, stable or pinned tags, the replay recorder head, CSP, consent modes, protected actions, and the check that it works.

3. Receive Risk Scores

Listen for the documented result event after successful collection or a cache hit:

document.addEventListener('noxtica:collected', (event) => {
	const { fingerprintId, score, risk_level, confidence, flags, fromCache } = event.detail;

	// Send the device handle to your backend with the customer action.
	// Treat score, confidence, and flags as policy inputs—not an identity verdict.
});

Do not put a secret Server API key in this handler. Use the browser result to shape reversible experience choices or send its device handle to your backend for a trusted lookup.

4. Server-side Lookups (Optional)

Create a Server API key in Backoffice → API Config, select the narrowest required scope, save the secret when shown, and call the supported endpoint from your backend:

curl -H "Authorization: Bearer sk_prod_your_api_key" \
  "https://collect.noxtica.com/v1/device/DEVICE_ID"

Handle 401, 403, 404, and 429 explicitly. A missing or expired device should follow your unknown path rather than being treated as safe or malicious. See Backend Integration for response fields, caching, and error handling.

Guides

Integrate

• Getting Started: account prerequisites, the evaluation path, and application responsibilities.
• Install & Browser Runtime: the single install guide: core and extensions scripts, stable or pinned tags, replay recorder head, CSP, consent modes, protected actions, single-page apps, storage disclosure, and the check that it works.
• Backend Integration: scoped server keys, trusted lookups, errors, rate limits, and backend decision patterns.

Decide and investigate

• Detection Signals: what each evidence layer contributes and how missing evidence affects confidence.
• Threat Categories: public reason families, appropriate uses, and common false-positive boundaries.
• Why Calibration, Not Verdicts: map risk and confidence to route-specific policy.
• Use Cases: reference patterns for marketplaces, financial services, identity-sensitive flows, and agent governance.

Operate and govern

• Customer Capability Reference: the complete customer-facing capability directory with surfaces, outputs, eligibility, and limits.
• Impact by Audience: responsibilities and outcomes for security teams, platforms, end users, and agent owners.
• Platform Overview: the reference version of the home-page sections, from customer value and the platform tour to capability families, principles, replay context, AI guardrails, and next steps.
• Pricing Reference: the explanatory text behind the pricing page — billing disclosures, comparison dimensions, add-ons, KYC and metered-module notes, estimator definitions, and commercial FAQ.
• Engineering Principles: the operational review checks behind defensible decisions.
• Concepts & Glossary: shared terms for device intelligence, agent controls, browser security, MCP, and the assistant.

Browse by section

Every customer-facing feature has one task-oriented page with the same layout: what it is, prerequisites, steps, how to verify, troubleshooting and related pages. The Server APIs section is the generated API reference.

Server APIs

• Server API reference: authentication, errors, rate limits, webhooks, the MCP server and the generated endpoint reference.

Browser SDK

• Install & Browser Runtime: The one install guide for the Noxtica collector: core and extensions scripts, stable or pinned tags, recorder head, CSP, consent, protected actions, and checks.
• Script attributes and client options: Every data-* attribute on the Noxtica script tag and every createClient or init option, with accepted values, defaults and effect.
• Client API, events and the command queue: The page globals, the methods of window.noxticaClient, every noxtica:* event, the window.noxtica command queue and the checkOnce result, as the loader implements them.
• Consent modes, GPC and Google Consent Mode: Set a consent mode per domain, declare it on the tag, connect your banner to the four categories, handle GPC and DNT, bridge Google Consent Mode v2 and test it.
• Protected actions: client trigger and server check: Declare protected actions per domain, trigger the minimal check from a form or code, carry the request id to your backend and redeem it with the verify call.
• Single-page apps, frameworks and tag managers: Load the Noxtica collector once in a single-page app, handle route changes and framework forms, and install it through a tag manager or a CMS theme.
• Content Security Policy, hosts and first-party relay: Allow the collector and ingest hosts in your Content Security Policy, know what degrades without WebAssembly, and serve the collector from your own subdomain.
• Browser SDK troubleshooting: Match a browser collector symptom to its cause and fix: token errors, consent gating, extension load reasons, CSP, duplicate tags and browser limits.
• SDK family and availability: browser, server and mobile: What the browser script, the typed browser wrapper, the server and mobile SDKs, Postman and OpenAPI are for, their source versions and how to get access.
• SDK Changelog: Release notes for the Noxtica browser collector SDK: what changed in each version, who is affected, what to do, and which @noxtica/sdk version pairs with which collector release.

Identity verification

• Identity verification integration: Create a hosted identity verification session from your server, send the customer to the link, and read the outcome by status read or signed event.
• Self-hosted identity verification (direct API): Call the identity verification API directly from your server: mint a nonce, run a verification, read the result, and learn what the direct route does and does not cover today.
• Invitations and hosted verification settings: Set up the hosted verification page in Backoffice, record the legal basis, send a customer a one-time verification link without code, and read the result.
• Identity verification events and webhooks: Register a signed HTTPS endpoint in Backoffice, verify every delivery, and handle each identity verification event: when it fires, its fields, retries and duplicates.
• Noxtica Verification ID (NVID): Read a Noxtica Verification ID from the session status or an event, understand its statuses and validity, share the public status link, and revoke or resend it in Backoffice.
• Business and merchant verification (KYB and KYM): Create hosted business (KYB) and merchant (KYM) onboarding sessions, follow them in Backoffice and receive notify-only events. Availability depends on your organisation.
• Verification data: storage, access and deletion: What happens to identity, business and merchant verification details and evidence over time, who can see them, and how a tenant administrator deletes them.
• Identity verification FAQ and troubleshooting: Short answers to the questions integrators ask about hosted identity verification: statuses, review, links, keys, events, the Verification ID and data, plus a five-step triage.
• Identity verification operations in Backoffice: Work the Backoffice KYC pages day to day: read cases, decide the review queue, follow processes, manage policies, screening, recovery, delegations, evidence access and device trust.
• KYC Hosted Sessions: How long a hosted KYC verification link stays open, and what your backend sees once it expires.

Observability: RUM, replay, APM and SEO

• Observability overview: RUM, replay, APM and ingest: Map each browser observability tool to what it measures, the Backoffice page that shows it, what you install, and the consent and legal-basis gates it needs.
• Real user monitoring and Web Vitals: Turn on real user monitoring for a domain, record its consent and Do Not Track decision, and read Web Vitals, errors and SDK health in Backoffice.
• Browser errors, console logs and source maps: Capture redacted JavaScript errors and masked console logs, upload source maps from your build, and read grouped errors on the Issues page.
• Session replay: setup, masking and playback: Arm session replay for a domain, choose what is masked, set sampling and limits, then find and play back recorded sessions in Backoffice.
• Custom events, session tags and request tracing: Send custom events, tag and identify sessions without sending raw ids, and join a browser request to your backend with W3C trace headers.
• Behavior analytics: heatmaps, journeys and funnels: Switch on the tracker for a domain, then read click and scroll heatmaps, page-to-page journeys and app-event funnels in Backoffice.
• APM and the ingestion service (OTLP): Mint an Ingestion API key in Backoffice, point an OpenTelemetry exporter at the ingestion service, send a test trace and a release marker, and find them in the APM explorers.
• SEO tools: page checks, site crawls and search score: Prove you own a hostname, run a single-page SEO check or a bounded site crawl in Backoffice, read the issues and the search score, and see Core Web Vitals history.
• Connect Google Search Console for a domain: Connect a domain to its own Google Search Console property with a service account key or your own OAuth client, test the connection, and use it as ownership proof for SEO tools.
• Uptime checks, alerts, status reports and the status page: Add verified uptime checks, route alerts to Slack, Teams, Telegram, e-mail or a signed webhook, turn periodic status reports on or off, and follow the public status page and its Atom feed.

Hunter, Spot and Pulse

• Hunter browser extension: Run a local audit of which scripts on one page probe browser fingerprinting APIs, read and export the report, and optionally send one previewed report to your Noxtica workspace.
• Hunter reports in Backoffice: Create a short-lived upload token, review Hunter page-audit reports your team sent to the workspace, download the stored JSON, and delete one report or every report from one reporter.
• Spot captures: Connect the Spot extension with a short-lived token, record one tab or desktop capture with bounded developer context, then review, share and delete captures in Backoffice.
• Noxtica Pulse: endpoint telemetry overview: Understand what Noxtica Pulse is, who sees what, how Backoffice configures it, what the desktop client and the player site do, and where the privacy controls and server API are.
• Pulse in Backoffice: applications, profiles, bundles and rollouts: Register a Pulse application, author and validate a profile, publish it as a signed bundle, follow the staged rollout, and halt, resume or roll back from Backoffice.
• Pulse detections, response, devices and privacy: Review Pulse detections with a person in the loop, answer appeals, set the response ladder, manage devices and attestation, read the privacy page, and use the tenant API and webhooks.

Security administration and attestation

• Device and app attestation: Register Android and iOS apps for Play Integrity and App Attest, call the two mobile attestation routes from your backend, and read the results in Backoffice.
• Sign-in, SSO, SCIM, MFA and IP allowlist: Set up how your team signs in to Backoffice: passwords, authenticator apps, security keys, SSO, SCIM, a tenant-wide MFA rule, IP allowlists, sessions and invitations.
• Roles and permissions: See what the viewer, analyst, admin and billing roles can do in Backoffice, which actions need a step-up MFA check, and how admins manage users, disabling and MFA resets.
• Audit log and data export: Read who changed what in your Backoffice workspace, filter and export the audit log, run a data export, and review export history. Includes limits and the API export route.

Backoffice guide

• Backoffice guide: navigation, roles and shortcuts: Find any Backoffice page, see which role can open it, and move faster with the command palette, G shortcuts, the workspace switcher and page help.
• Domains, site keys and the install card: Register a domain, copy its public site key, open the install card, and manage the per-domain settings, key rotation and deletion in Backoffice.
• Fingerprints, analytics and live monitoring: Search device fingerprints, read a device record, watch live traffic, compare devices and use the analytics, geo-risk and hardware attestation views in Backoffice.
• Risk actions, investigations and entity lookup: Use Risk Actions, Agentic Security, Bot Intelligence, Behavioral Corroboration, Investigations, Entity Lookup and Quality & Calibration to validate policy before you enforce it.
• Detection and collection settings: Tune rules, risk scoring, client cost levels, verdict bands, honeypots, the collector refresh interval, probes and behavioral signals, and roll changes out in a safe order.
• Integrations and API pages: A map of the Integrations & API sidebar group: what each page does, who can open it, which credentials it mints, and which documentation page covers it.
• Event sinks (SIEM export): Create an event sink that pushes signed verdict and audit events to your SIEM, arm it, send a test request, inspect deliveries and rotate its signing secret.
• AI assistant, MCP tokens and coding-agent keys: Open the Backoffice assistant, set model routing and provider keys, mint MCP tokens with read scopes, and create coding-agent keys, with the limits Backoffice shows.
• Workspace gates, feature flags, data operations and mobile operations: Use Workspace Gates, visitor Feature Flags, Data Operations, Mobile Operations and your personal Settings and Notifications in Backoffice, with the roles and MFA checks each needs.

Billing and usage

• Plans, packages and add-ons: Request a plan change or extra capacity, compare and subscribe to packages, turn module add-ons on, and read why an item is unavailable before you click it.
• Usage, quotas and metering: Read your usage against plan quotas in Backoffice: the Usage & Quotas tabs, the meters, how each quota counts, what happens at the limit, KYC usage, and how to set a quota alert.
• Wallet, invoices and reports: Add funds to your wallet, set a low-balance warning, read the ledger and AI credits, open invoices, review sent reports, and control status-report e-mails in Backoffice.
• Billing status, grace period and reminders: Understand the Backoffice billing banners, the package grace window and what pauses when it ends, and the schedule of billing reminder e-mails, so you can act before service pages pause.

Compliance and legal

• Privacy and compliance controls in Backoffice: Find every Privacy & Legal and Web Analytics & Privacy page in Backoffice, who can use it, what it records and which docs page explains it.
• Legal basis register and receipts: Record, change and withdraw the legal basis your organisation asserts for gated features, and learn which features refuse to start without a receipt.
• Data retention, raw IP storage and data locations: Set how long browser intelligence data is kept, decide whether full IP addresses are stored, and read where each kind of your data is stored.
• Data subject scope, erasure requests and account deletion: Learn which deletion routes exist in Backoffice, how an administrator removes end-user data, and how identity verification data and accounts are deleted.
• Cookies, storage and consent categories for your site: List the cookies and browser storage the Noxtica SDK writes, map each to a consent category, disclose them in your cookie policy and set DNT and GPC behaviour.
• DPA, sub-processors, DPIA pointers and assurance: Find the public DPA and sub-processor pages, accept the AI assistant as a sub-processor in Backoffice, and know where to ask for DPIA and assurance material.

Risk Levels

Every assessment can include a numeric score and one of five plain-language levels. The fixed ranges below describe the current public response contract; they are not universal action thresholds.

Confidence answers a separate question: how much usable evidence supported the assessment. Low confidence should normally move a decision toward defer, collect more evidence, or a reversible challenge—not toward an irreversible block.

Dashboard

Manage your activated account in Backoffice. Start with the selected tenant and domain, then use Analytics for population behavior, Fingerprints for individual records, Risk Actions for policy outcomes, and Usage for current limits. The pages you see depend on your role and enabled modules.

At a Glance

• Integration model: domain-bound browser Site Key plus optional scoped server credentials.
• Primary output: score, five-level risk tier, confidence, named flags/reasons, and a tenant-scoped device handle.
• Collection cadence: cached and configurable; checkOnce() respects the applicable interval.
• Decision owner: your route-specific policy; Noxtica supplies evidence and eligible enforcement surfaces.
• Availability: plan, contract, role, tenant/domain configuration, client support, quota, and legal-basis gates can apply.
• Performance: measure your selected client, configuration, geography, network, and cache mix; this page makes no universal latency or availability commitment.

Support

• Access, provisioning, commercial eligibility, or technical support: Contact us.
• Before opening a ticket: include the tenant and domain, timestamp, customer-visible symptom, relevant request or device handle, and whether the result was cached. Do not send Server API secrets or unnecessary personal data.
• Capability question: link the applicable capability family and note whether its page or setting is visible in Backoffice.