How it works
On this page
The three parties #
- The visitor's browser loads the BlockAlt script from https://blockalt.click. When the visitor submits, the script fetches your site's signed configuration, solves a proof-of-work challenge and receives a token.
- Your backend receives the token together with the form or API request, and calls
POST /v1/siteverifywith your secret key. - BlockAlt answers with a decision,
success: trueorfalse, and a reason. Your backend performs the action only whensuccessistrue.
Your traffic never passes through BlockAlt, and you keep your hosting and DNS.
Keys #
| Key | Looks like | Where it lives |
|---|---|---|
| Public site key | ba_pk_… | In your page. Identifies the site; safe to publish |
| Secret key | ba_sk_… | On your server only, for example in BLOCKALT_SECRET. Shown once when created |
| Configuration public keys | MCowBQYDK2VwAyEA… | In your page. The script accepts only configuration signed by one of them |
Lifetimes #
| Object | Lifetime | Notes |
|---|---|---|
| Signed site configuration | 5 minutes | Bound to your site key and the page's hostname |
| Proof-of-work challenge | 90 seconds | Works once |
| Token | 120 seconds | Works once; bound to the site, hostname, action and published configuration version |
Site states #
| State | What visitors get | What siteverify answers |
|---|---|---|
| Protected | The script does the work and gets a token | accepted or a refusal reason |
| Unpaid (priced workspace whose free allowance is used up, without credit) | No work; the script returns an empty token | success: true, reason unpaid |
| Paused | No work; the script returns an empty token | success: true, reason paused |
| Lockdown (rule blocking all issuance) | Every action is refused | success: false, reason rule_blocked |
| Suspended by BlockAlt support (abuse) | Every action is refused | success: false, reason suspended |
When several apply, the first one in this order decides: suspended, lockdown, paused, unpaid, protected. Always forward the token, even when it is empty, and let siteverify decide. See pause and lockdown and billing.
What it is not #
Proof of work raises the cost of automated requests and, with per-visitor limits, shapes their rate. It does not prove that a visitor is human: a bot that pays the computing cost can still pass, at the rate you allow. BlockAlt is not a proxy or WAF, and a token is not an identity: keep your own authentication and authorisation.
Next steps #
- Quickstart: protect a sign-up form end to end.
- Server verification: every field, reason and HTTP status.
- Framework guides for Next.js, Express, Django, Laravel, WordPress and more.
Something unclear or missing on this page? Write to support@blockalt.click.