How the verification flow is designed
The browser runs a verification check and sends results to the InstantBlock engine. The engine returns a signed token containing a decision. Your backend should validate the token signature and expiry, then check that the decision is accepted before allowing a protected action.
Keep secrets on the server
The sitekey is public and belongs in browser code. The site secret and API keys belong on your server and must never be embedded in a page or client bundle.
Plan for review
Use dashboard outcomes and your own application logs to monitor the integration. Review challenges and blocks for legitimate traffic as well as abuse. This is a product security overview, not a certification or contractual security schedule.