Integrate SignalGate

1. 1

   Sign up and create an API key.

   Sign up at /signup, then go to Settings → API Keys → click “+ Create Key”. Your key starts with pk_live_ and is shown exactly once.

   The dashboard also surfaces your tenant's public keyat this step. You'll paste it into the frontend SDK in Step 2.

2. 2

   Integrate the frontend SDK.

   Drop the SDK on every page where a sensitive action lives (login, signup, payment, OTP request). On submit, you receive an encrypted four-field envelope.

   See Frontend SDK reference → for install options, configuration, and the payload shape.

3. 3

   Pass the fingerprint payload to your backend.

   Recommended: include the envelope in your existing request body as a top-level signalgate field.

   This is your call, not ours. Anything that gets the four-field envelope from the browser to your backend works — request body, custom header, dedicated endpoint, message queue. Pick whatever fits your stack.
4. 4

   Install the backend SDK.

   Backend SDKs ship for Python, Node.js, Go, Java, PHP and C# (.NET) today. See Backend SDK reference → for install, client setup, and full code examples in every stack. For any other language, the HTTP API is small enough to wrap directly.

1. 5

   Log every action AND every target action.

   SignalGate learns from labeled pairs: the sensitive action, logged after it happens, and the target action, logged after it succeeds — once you've confirmed the action was legitimate. Both calls use client.log() — fire-and-forget, no verdict returned.

   See the event model below for what counts as an “action” vs “target action” in different scenarios.

   Don't skip the target_action log.Without it, SignalGate sees actions but can't tell which ones were legitimate. Detection trained on action-only data will misidentify normal users at random.
2. 6

   Let events accumulate.

   Both call types stream into your Events feed. Keep the SDK in your hot path; real traffic does the rest. For most products, gathering enough events takes a few days.

3. 7

   Create a flow in the dashboard.

   A flowtells SignalGate “for this method, find patterns that distinguish target actions from abandoned ones.” In the dashboard: click New flow on the Flows card, pick the method (e.g. login), name it, submit.

   Flow configurationis also exposed in the dashboard. Default settings cover most use cases out of the box; as you tune to your traffic shape you'll find knobs for sensitivity, minimum group size, and how aggressively the engine acts. Concrete options are still being finalized during the beta — start with defaults, or book a demo to talk through your setup.
4. 8

   Let SignalGate learn from your traffic.

   Once it has learned enough from your traffic, detection turns on automatically for the workflows you've enabled — but it doesn't affect live traffic until you start calling check() in Step 9.

5. 9

   Enable check() at the action place.

   Add a check() call before the action to get a verdict and decide whether to allow it. Keep the log() calls after the action succeeds and after the target-action succeeds, so learning continues with enforcement on.

   See Verdicts → for the verdict actions and how to handle each.

Need a client for a language not listed? The HTTP API is small enough to wrap yourself, or talk to us about prioritizing an official SDK.