Integrate SignalGate

1. 1

   Sign up and create an API key.

   Sign up at /signup, then go to Settings → API Keys → click “+ Create Key”. Your key starts with pk_live_ and is shown exactly once.

   The dashboard also surfaces your tenant's public keyat this step. You'll paste it into the frontend SDK in Step 2.

2. 2

   Integrate the frontend SDK.

   Drop the SDK on every page where a sensitive action lives (login, signup, payment, OTP request). On submit, you receive an encrypted four-field envelope.

   See Frontend SDK reference → for install options, configuration, and the payload shape.

3. 3

   Pass the fingerprint payload to your backend.

   Recommended: include the envelope in your existing request body as a top-level signalgate field.

   This is your call, not ours. Anything that gets the four-field envelope from the browser to your backend works — request body, custom header, dedicated endpoint, message queue. Pick whatever fits your stack.
4. 4

   Install the backend SDK.

   Backend SDKs ship for Python, Node.js, Go and Java today. See Backend SDK reference → for install, client setup, and full code examples in every stack. For any other language, the HTTP API is small enough to wrap directly.

1. 5

   Log every action AND every target action.

   SignalGate learns from labeled pairs: the moment a sensitive action is attempted, and the moment it's confirmed legitimate. Both calls use client.log() — fire-and-forget, no verdict returned.

   See the event model below for what counts as an “action” vs “target action” in different scenarios.

   Don't skip the target_action log.Without it, SignalGate sees attempts but can't tell which ones were legitimate. Detection trained on action-only data will misidentify normal users at random.
2. 6

   Let events accumulate.

   Both call types stream into your Events feed. Keep the SDK in your hot path; real traffic does the rest. The dashboard surfaces a readiness indicator per method — wait until it goes green before moving on. For most products this takes a few days.

3. 7

   Create a flow in the dashboard.

   A flowtells SignalGate “for this method, find patterns that distinguish target actions from abandoned ones.” In the dashboard: click Flows → New, pick the method (e.g. login), name it, submit.

   Flow configurationis also exposed in the dashboard. Default settings cover most use cases out of the box; as you tune to your traffic shape you'll find knobs for sensitivity, minimum group size, and how aggressively the engine acts. Concrete options are still being finalized during the beta — start with defaults, or book a demo to talk through your setup.
4. 8

   Let SignalGate learn from your traffic.

   Once it has learned enough from your traffic, detection turns on automatically for the workflows you've enabled — but it doesn't affect live traffic until you start calling check() in Step 9.

5. 9

   Enable check() at the action place.

   Add a check() call before the action to get a verdict and decide whether to allow it. Keep the log() calls after the action succeeds and after the target-action succeeds, so learning continues with enforcement on.

   See Verdicts → for the verdict actions and how to handle each.

Need a client for a language not listed? The HTTP API is small enough to wrap yourself, or talk to us about prioritizing an official SDK.