Noxtica Documentation
Use these docs to move from an activated account to a measured, reviewable policy. Noxtica provides browser and device intelligence, calibrated risk, bot and agent controls, and operator workflows; your team chooses where those outputs influence a customer journey.
Availability is account-specific. Backoffice visibility, API scopes, module status, and your service agreement determine which surfaces you can use. A capability described in the directory may still require entitlement, tenant or domain activation, a supported client, or privacy/legal review.
Choose a path by task
| I need to… | Start here | Then use |
|---|---|---|
| Install the browser collector | Getting Started | Browser Runtime for caching, events, modes, CSP, and troubleshooting |
| Make a trusted backend decision | Backend Integration | Why Calibration, Not Verdicts for policy design |
| Understand a score or reason | Detection Signals | Threat Categories and the fingerprint detail in Backoffice |
| Roll out challenge or block actions | Use Cases | Engineering Principles for shadow-first and low-confidence handling |
| Investigate related activity | Capability Reference → Account linking | Compare, investigation, analytics, and eligible export surfaces in Backoffice |
| Govern automated agents | Capability Reference → Agent identity | Agentic Security and Know Your Agent |
| Connect an AI agent or use the console assistant | Capability Reference → AI operations | MCP Integration or AI Assistant |
| Review privacy and operating boundaries | Engineering Principles | Capability Reference → Governance plus your contract and current legal pages |
| See everything customers can use | Customer Capability Reference | Follow any of the twelve family anchors to configuration, outputs, value, eligibility, and limits |
What is Noxtica?
Noxtica collects eligible browser, device, network, and interaction context, checks the available evidence for consistency, and returns a calibrated assessment. A result can help you recognize a returning browser installation, identify suspicious automation or infrastructure, verify supported agent identities, prioritize an investigation, or apply a route-specific policy.
The result is not proof that a visitor is a particular person, a guaranteed bot verdict, or a replacement for authentication. Read risk, confidence, and reasons together and combine them with the value and reversibility of the action your application is considering.
Key Capabilities
- Device and browser intelligence: receive a tenant-scoped device handle and a calibrated assessment from an activated collector.
- Bot, abuse, and network defense: combine automation, consistency, infrastructure, and interaction reason families without making one signal decisive.
- Risk and decisioning: use score, five-level risk tier, confidence, and reasons in customer-owned allow, observe, challenge, review, or block policies.
- Agent identity and control: apply separate trust policies to supported signed agents and unknown automation when the module is enabled.
- Investigation and operations: review device records, trends, policy outcomes, audit history, alerts, and eligible exports in Backoffice.
- Integrations: consume browser events, scoped backend reads, SDKs, event delivery, exports, and eligible read-only MCP access.
See the Customer Capability Reference for every public family, where it appears, what it produces, and what must be enabled.
Platform Components
| Component | Customer purpose | Availability boundary |
|---|---|---|
| Browser collector | Collect and submit an eligible assessment; return browser events and cache state | Requires an activated domain and Site Key; optional signal families have separate policy gates |
| Collector service | Score submissions and expose supported verification and lookup APIs | Endpoints, quotas, and modules vary by tenant and contract |
| Backoffice | Configure domains and eligible modules; review analytics, records, actions, access, and usage | Pages and actions are filtered by operator role, tenant scope, and entitlement |
| Server API and SDKs | Read results and make decisions from trusted backend code | Requires a secret key with the necessary scope; never place server credentials in the browser |
| Integration outputs | Deliver eligible events through webhooks, sinks, exports, or read-only MCP | Requires destination/token configuration and any applicable module, role, and data-policy review |
Quick Start
1. Get Your Site Key
Request access through Contact. After your account is provisioned, sign in to Backoffice, add the exact production or staging origin under Domains, and copy its Site Key. Keep environments separate; a Site Key is public but origin-bound.
2. Add the Collector
Place the synchronous replay preloader first in <head>, followed by the asynchronous collector:
<script
src="https://collect.noxtica.com/collector/noxtica-recorder-head.d9ae068e.js"
integrity="sha384-0aarRZ9aHZq4csV3R+MzJUTnerNzrddznWNV/KoKPkKp2Qh40kGsrFiPiMAuvmg9"
crossorigin="anonymous"
></script>
<script
src="https://collect.noxtica.com/collector/noxtica.js"
data-site-key="pk_prod_your_site_key_here"
data-auto-init
data-auto-check-once
async
></script>The preloader buffers a bounded early window in memory and has no transport. The asynchronous collector drains it only after the configured replay admission checks allow capture; otherwise the queue is discarded. Sites that do not use replay may omit it. See Getting Started → Automatic Collection for the current integrity value, strict-CSP nonce form, consent behavior, and alternatives.
Content Security Policy
If you use a content-security-policy, add only the sources and execution permissions required by the integration mode you selected. The current reference configuration is maintained in Getting Started → Content Security Policy. Test your policy in a non-production domain and monitor noxtica:error; a restricted policy can reduce available protection or prevent collection.
3. Receive Risk Scores
Listen for the documented result event after successful collection or a cache hit:
document.addEventListener('noxtica:collected', (event) => {
const { fingerprintId, score, risk_level, confidence, flags, fromCache } = event.detail;
// Send the device handle to your backend with the customer action.
// Treat score, confidence, and flags as policy inputs—not an identity verdict.
});Do not put a secret Server API key in this handler. Use the browser result to shape reversible experience choices or send its device handle to your backend for a trusted lookup.
4. Server-side Lookups (Optional)
Create a Server API key in Backoffice → API Config, select the narrowest required scope, save the secret when shown, and call the supported endpoint from your backend:
curl -H "Authorization: Bearer sk_prod_your_api_key" \
"https://collect.noxtica.com/v1/device/DEVICE_ID"Handle 401, 403, 404, and 429 explicitly. A missing or expired device should follow your unknown path rather than being treated as safe or malicious. See Backend Integration for response fields, caching, and error handling.
Guides
Integrate
- Getting Started: account prerequisites, domains, collector installation, modes, parameters, CSP, consent-sensitive options, and response shape.
- Browser Runtime: lifecycle, browser events, caching, force refresh, cross-tab behavior, supported clients, and troubleshooting.
- Backend Integration: scoped server keys, trusted lookups, errors, rate limits, and backend decision patterns.
Decide and investigate
- Detection Signals: what each evidence layer contributes and how missing evidence affects confidence.
- Threat Categories: public reason families, appropriate uses, and common false-positive boundaries.
- Why Calibration, Not Verdicts: map risk and confidence to route-specific policy.
- Use Cases: reference patterns for marketplaces, financial services, identity-sensitive flows, and agent governance.
Operate and govern
- Customer Capability Reference: the complete customer-facing capability directory with surfaces, outputs, eligibility, and limits.
- Impact by Audience: responsibilities and outcomes for security teams, platforms, end users, and agent owners.
- Engineering Principles: the operational review checks behind defensible decisions.
- Concepts & Glossary: shared terms for device intelligence, agent controls, browser security, MCP, and the assistant.
Risk Levels
Every assessment can include a numeric score and one of five plain-language levels. The fixed ranges below describe the current public response contract; they are not universal action thresholds.
| Score | Level | Interpret as | Common starting action |
|---|---|---|---|
| 0–19 | minimal | Little risk evidence in the available assessment | Allow; retain normal controls |
| 20–39 | low | Minor or explainable anomalies | Allow and observe |
| 40–59 | medium | Mixed or incomplete suspicious evidence | Observe or use a low-friction step-up |
| 60–79 | high | Strong suspicious evidence | Challenge, hold, or review |
| 80–100 | critical | Multiple or strong reason families agree | Strong challenge or block only under a reviewed policy |
Confidence answers a separate question: how much usable evidence supported the assessment. Low confidence should normally move a decision toward defer, collect more evidence, or a reversible challenge—not toward an irreversible block.
Dashboard
Manage your activated account in Backoffice. Start with the selected tenant and domain, then use Analytics for population behavior, Fingerprints for individual records, Risk Actions for policy outcomes, and Usage for current limits. The pages you see depend on your role and enabled modules.
At a Glance
- Integration model: domain-bound browser Site Key plus optional scoped server credentials.
- Primary output: score, five-level risk tier, confidence, named flags/reasons, and a tenant-scoped device handle.
- Collection cadence: cached and configurable;
checkOnce()respects the applicable interval. - Decision owner: your route-specific policy; Noxtica supplies evidence and eligible enforcement surfaces.
- Availability: plan, contract, role, tenant/domain configuration, client support, quota, and legal-basis gates can apply.
- Performance: measure your selected client, configuration, geography, network, and cache mix; this page makes no universal latency or availability commitment.
Support
- Access, provisioning, commercial eligibility, or technical support: Contact us.
- Before opening a ticket: include the tenant and domain, timestamp, customer-visible symptom, relevant request or device handle, and whether the result was cached. Do not send Server API secrets or unnecessary personal data.
- Capability question: link the applicable capability family and note whether its page or setting is visible in Backoffice.