01
Challenge
The loader pulls a fresh nonce, a proof-of-work target, a per-session VM program and an integrity nonce — wrapped in an opaque binary envelope.
Pipeline
Challenge. Verify. Verdict.
Three stages on every protected request — end to end in under 200ms.
02
Verify
A Rust→WASM core fingerprints the browser across 190+ signals, runs the VM, solves the proof-of-work and collects automation + behaviour probes — posted back inside the envelope.
03
Verdict
The engine scores seven dimensions into one number and signs a token. Humans get accept; bots get a poisoned reject — a silent 200 they never question.
Bot / Human
Request
InstantBlock
7-dimension score
Verified ✓
Your API
Rejected
Poisoned token
200 OK — bot thinks it won
Integration
One script. One offline check.
Drop the loader on your page; verify the token in your backend with your site secret. No callback to us on the happy path.
// frontend import { runChallenge } from 'https://your-engine/client/api.js'; const { token } = await runChallenge({ sitekey: 'IB-S-…' }); // backend — offline const claims = verifyToken(token, SITE_SECRET); if (!claims || claims.decision !== 'accept') return block();