Create account
Sign inCreate account
Changelog

What changed

Releases of the API, the browser script and the SDKs, with the compatibility promise for installed sites.

Current browser script

What this server serves now.

Version
0.3.0
Size
4,640 bytes gzip
Current browser script
/v1/assets/blockalt.c8b2d9539dbbc932999adb0f51a36bddd4e99899f543e1505818841878cf9813.js
Integrity
sha384-pblByFDqcJxRfhDh18GH3gRsWy9ZaS4AjDc6OpozzQqvkuYvyin+4BWcKXxA+bN8

The same values are served as JSON at /v1/script-manifest.

Compatibility promise

What stays true for installed sites.

  • A stable /v1 contract

    The /v1 HTTP contract and version 1 of the signed payloads are covered by compatibility tests. A breaking change needs a new major endpoint or payload version, announced here with a migration window before the old version is removed.

  • Pinned scripts keep working

    Files under /v1/assets/ are immutable and kept across releases, so a script pinned with Subresource Integrity keeps working. The /v1/blockalt.js alias always points at the latest script and is cached for five minutes.

  • Additions stay optional

    Responses may gain new optional fields and new refusal reasons. Treat unknown reasons as refusals; see server verification.

Releases

  1. 0.3.0Launch readiness

    Live on blockalt.click since 1 November 2026. The status page and /readyz show the version that is running.

    0.3.0 is the launch-readiness release: a faster and harder-to-cheat proof of work, browser and server SDKs you can install, a console that walks you through installation and keeps a long-term decision history, one prepaid credit wallet per workspace with a monthly free allowance, and stronger accounts with passkeys, sessions and scoped management API keys.

    Protection and API

    • POST /v1/siteverify accepts optional remoteip (refuses a token solved from another network with wrong_client) and idempotencyKey (a retried verification returns its first result), adds the reasons paused and wrong_client, and may return action, hostname and issuedAt.
    • Proof of work v2: eight small puzzles solved in background workers, a published difficulty capped at 16 bits plus adaptive bits for clients that ask for many challenges and during surges. Challenges and tokens are signed with server-only keys.
    • GET /v1/keys lists the configuration keys to pin (Ed25519 and P-256, then standby keys); the configuration also carries a P-256 signature for browsers without Ed25519.
    • Test keys that always pass, always fail or run real proof of work, usable on any origin and never billed.
    • Rate limits per site and per visitor network, with Retry-After on every 429. Tokens BlockAlt did not issue for a site (forged, malformed, empty, expired) are counted per minute rather than logged one by one and, like replayed tokens, spend a small budget of their own, so junk sent through your forms cannot use up your site's verification budget.

    SDKs

    • Browser SDK: execute(action, { signal, onProgress }), prepare(action), forms protected with data attributes, typed BlockAltError codes and BlockAlt.supported(), two requests per token and no CORS preflight. A token prepared while protection was paused or unpaid is checked again before it is used.
    • Server SDK @blockalt/server 0.3.0 as an installable package (npm install https://blockalt.click/sdk/blockalt-server-0.3.0.tgz), with distinct reasons for invalid secrets, malformed requests, rate limits and outages, and the read guard profiles dashboard, api and strict with a report-only mode. With the test secrets it gives the same answer on every call.

    Console

    • Guided installation with a live check for the first accepted verification, rules with versions, pause and lockdown, server keys with names and last use, a decision log with filters and CSV, long-term daily analytics, alert rules, email notifications and delivery status, site renaming and deletion.

    Billing

    • One prepaid credit wallet per workspace with a monthly free allowance, emails at 80 % and 100 % of the allowance, on low balance and when protection turns off, statements, receipts and CSV exports. Prices stay provisional and top-ups stay closed until they are announced.
    • Only accepted verifications are billed. Refusals, paused and unpaid answers are free.

    Accounts and team

    • Sign-up by emailed link, BlockAlt's own proof of work on the account forms, passkeys, a session list with idle timeout, a fresh second factor for sensitive changes (also invitations, server keys, site deletion, pausing or locking down protection and notification destinations), security notices by email, ownership transfer, an audit log, workspace export and deletion, and management API keys with scopes.

    Compatibility notes

    • Scripts you pinned keep working.

      Version 1 scripts under /v1/assets/ (with Subresource Integrity) keep their flow and stay served (a visitor network that asks for so many challenges that it would need more than the 20 bits they can solve is answered 429 until it slows down); your server code for 0.2.0 keeps working, because new response fields and reasons are optional. Treat reasons you do not know as refusals.

    • SIEM webhooks: the signature header changed.

      BlockAlt-Signature is now t=<unix seconds>,v1=<hex HMAC-SHA-256 of "<t>.<raw body>">, so receivers can refuse replays. The raw-body signature moves to BlockAlt-Body-Signature for the transition; switch your receiver to the timestamped check (how). Slack and Discord destinations are not affected.

    • "Disabled" protection becomes "Paused".

      A site that had protection turned off refused every action in 0.2.0. From 0.3.0 that state is paused: actions pass unchecked and unbilled (siteverify answers success: true with the reason paused). Refusing every action is now the explicit Lockdown in the console (pause and lockdown). If you turned protection off to block traffic, choose Lockdown.

    • Billing counts only accepted verifications.

      Usage is rated about every 30 seconds and posted to the ledger about once an hour; the balance never crosses zero or your warning threshold without the posting happening at once. The rating that uses up your credit goes below zero by at most one rating cycle of usage, or one block of 1,000 if rating has fallen behind; nothing counted after the credit ran out is charged (details).

    • Usage history from 0.2.0.

      0.2.0 also counted refused verifications in the daily usage. The upgrade takes out the refusals still on record (the last 7 days); older days of the usage history, in the console and in the usage CSV (accepted_verifications), still include them. From 0.3.0 only accepted verifications are counted.

    • New reason suspended.

      A site or workspace that BlockAlt support suspends for abuse refuses configuration, tokens and siteverify (never billed); the console shows support's note. When several states apply, the first of suspended, lockdown, paused, unpaid decides: lockdown now also holds while a site is paused.

  2. Unpaid sites stay reachable

    • A priced site with no credit left stays reachable and is not checked: siteverify answers success: true with the reason unpaid, and the signed configuration tells the script to skip the work. Sites without a price stay protected.

  3. Read guard for data APIs and streams

    Pilot
    • Read guard for data APIs and server-sent event streams (createReadGuard on the server, BlockAlt.createReader in the browser), in pilot.

  4. 0.2.0First public release

    • First public release at blockalt.click: content-addressed browser script with Subresource Integrity, Ed25519-signed site configuration, proof of work and POST /v1/siteverify.
    • Console with email verification, mandatory authenticator, recovery codes, team roles and audit log; hostname ownership by DNS TXT record; versioned rules with rollback; decision log and usage.
    • Slack, Discord and signed SIEM notifications.