Noxtica Documentation

Use these docs to move from an activated account to a measured, reviewable policy. Noxtica provides browser and device intelligence, calibrated risk, bot and agent controls, and operator workflows; your team chooses where those outputs influence a customer journey.

Availability is account-specific. Backoffice visibility, API scopes, module status, and your service agreement determine which surfaces you can use. A capability described in the directory may still require entitlement, tenant or domain activation, a supported client, or privacy/legal review.

Choose a path by task

I need to…	Start here	Then use
Install the browser collector	Getting Started	Browser Runtime for caching, events, modes, CSP, and troubleshooting
Make a trusted backend decision	Backend Integration	Why Calibration, Not Verdicts for policy design
Understand a score or reason	Detection Signals	Threat Categories and the fingerprint detail in Backoffice
Roll out challenge or block actions	Use Cases	Engineering Principles for shadow-first and low-confidence handling
Investigate related activity	Capability Reference → Account linking	Compare, investigation, analytics, and eligible export surfaces in Backoffice
Govern automated agents	Capability Reference → Agent identity	Agentic Security and Know Your Agent
Connect an AI agent or use the console assistant	Capability Reference → AI operations	MCP Integration or AI Assistant
Review privacy and operating boundaries	Engineering Principles	Capability Reference → Governance plus your contract and current legal pages
See everything customers can use	Customer Capability Reference	Follow any of the twelve family anchors to configuration, outputs, value, eligibility, and limits

What is Noxtica?

Noxtica collects eligible browser, device, network, and interaction context, checks the available evidence for consistency, and returns a calibrated assessment. A result can help you recognize a returning browser installation, identify suspicious automation or infrastructure, verify supported agent identities, prioritize an investigation, or apply a route-specific policy.

The result is not proof that a visitor is a particular person, a guaranteed bot verdict, or a replacement for authentication. Read risk, confidence, and reasons together and combine them with the value and reversibility of the action your application is considering.

Key Capabilities

Device and browser intelligence: receive a tenant-scoped device handle and a calibrated assessment from an activated collector.
Bot, abuse, and network defense: combine automation, consistency, infrastructure, and interaction reason families without making one signal decisive.
Risk and decisioning: use score, five-level risk tier, confidence, and reasons in customer-owned allow, observe, challenge, review, or block policies.
Agent identity and control: apply separate trust policies to supported signed agents and unknown automation when the module is enabled.
Investigation and operations: review device records, trends, policy outcomes, audit history, alerts, and eligible exports in Backoffice.
Integrations: consume browser events, scoped backend reads, SDKs, event delivery, exports, and eligible read-only MCP access.

See the Customer Capability Reference for every public family, where it appears, what it produces, and what must be enabled.

Platform Components

Component	Customer purpose	Availability boundary
Browser collector	Collect and submit an eligible assessment; return browser events and cache state	Requires an activated domain and Site Key; optional signal families have separate policy gates
Collector service	Score submissions and expose supported verification and lookup APIs	Endpoints, quotas, and modules vary by tenant and contract
Backoffice	Configure domains and eligible modules; review analytics, records, actions, access, and usage	Pages and actions are filtered by operator role, tenant scope, and entitlement
Server API and SDKs	Read results and make decisions from trusted backend code	Requires a secret key with the necessary scope; never place server credentials in the browser
Integration outputs	Deliver eligible events through webhooks, sinks, exports, or read-only MCP	Requires destination/token configuration and any applicable module, role, and data-policy review

Quick Start

1. Get Your Site Key

Request access through Contact. After your account is provisioned, sign in to Backoffice, add the exact production or staging origin under Domains, and copy its Site Key. Keep environments separate; a Site Key is public but origin-bound.

2. Add the Collector

Place the synchronous replay preloader first in <head>, followed by the asynchronous collector:

<script
	src="https://collect.noxtica.com/collector/noxtica-recorder-head.d9ae068e.js"
	integrity="sha384-0aarRZ9aHZq4csV3R+MzJUTnerNzrddznWNV/KoKPkKp2Qh40kGsrFiPiMAuvmg9"
	crossorigin="anonymous"
></script>
<script
	src="https://collect.noxtica.com/collector/noxtica.js"
	data-site-key="pk_prod_your_site_key_here"
	data-auto-init
	data-auto-check-once
	async
></script>

The preloader buffers a bounded early window in memory and has no transport. The asynchronous collector drains it only after the configured replay admission checks allow capture; otherwise the queue is discarded. Sites that do not use replay may omit it. See Getting Started → Automatic Collection for the current integrity value, strict-CSP nonce form, consent behavior, and alternatives.

Content Security Policy

If you use a content-security-policy, add only the sources and execution permissions required by the integration mode you selected. The current reference configuration is maintained in Getting Started → Content Security Policy. Test your policy in a non-production domain and monitor noxtica:error; a restricted policy can reduce available protection or prevent collection.

3. Receive Risk Scores

Listen for the documented result event after successful collection or a cache hit:

document.addEventListener('noxtica:collected', (event) => {
	const { fingerprintId, score, risk_level, confidence, flags, fromCache } = event.detail;

	// Send the device handle to your backend with the customer action.
	// Treat score, confidence, and flags as policy inputs—not an identity verdict.
});

Do not put a secret Server API key in this handler. Use the browser result to shape reversible experience choices or send its device handle to your backend for a trusted lookup.

4. Server-side Lookups (Optional)

Create a Server API key in Backoffice → API Config, select the narrowest required scope, save the secret when shown, and call the supported endpoint from your backend:

curl -H "Authorization: Bearer sk_prod_your_api_key" \
  "https://collect.noxtica.com/v1/device/DEVICE_ID"

Handle 401, 403, 404, and 429 explicitly. A missing or expired device should follow your unknown path rather than being treated as safe or malicious. See Backend Integration for response fields, caching, and error handling.

Guides

Integrate

Getting Started: account prerequisites, domains, collector installation, modes, parameters, CSP, consent-sensitive options, and response shape.
Browser Runtime: lifecycle, browser events, caching, force refresh, cross-tab behavior, supported clients, and troubleshooting.
Backend Integration: scoped server keys, trusted lookups, errors, rate limits, and backend decision patterns.

Decide and investigate

Detection Signals: what each evidence layer contributes and how missing evidence affects confidence.
Threat Categories: public reason families, appropriate uses, and common false-positive boundaries.
Why Calibration, Not Verdicts: map risk and confidence to route-specific policy.
Use Cases: reference patterns for marketplaces, financial services, identity-sensitive flows, and agent governance.

Operate and govern

Customer Capability Reference: the complete customer-facing capability directory with surfaces, outputs, eligibility, and limits.
Impact by Audience: responsibilities and outcomes for security teams, platforms, end users, and agent owners.
Engineering Principles: the operational review checks behind defensible decisions.
Concepts & Glossary: shared terms for device intelligence, agent controls, browser security, MCP, and the assistant.

Risk Levels

Every assessment can include a numeric score and one of five plain-language levels. The fixed ranges below describe the current public response contract; they are not universal action thresholds.

Score	Level	Interpret as	Common starting action
0–19	`minimal`	Little risk evidence in the available assessment	Allow; retain normal controls
20–39	`low`	Minor or explainable anomalies	Allow and observe
40–59	`medium`	Mixed or incomplete suspicious evidence	Observe or use a low-friction step-up
60–79	`high`	Strong suspicious evidence	Challenge, hold, or review
80–100	`critical`	Multiple or strong reason families agree	Strong challenge or block only under a reviewed policy

Confidence answers a separate question: how much usable evidence supported the assessment. Low confidence should normally move a decision toward defer, collect more evidence, or a reversible challenge—not toward an irreversible block.

Dashboard

Manage your activated account in Backoffice. Start with the selected tenant and domain, then use Analytics for population behavior, Fingerprints for individual records, Risk Actions for policy outcomes, and Usage for current limits. The pages you see depend on your role and enabled modules.

At a Glance

Integration model: domain-bound browser Site Key plus optional scoped server credentials.
Primary output: score, five-level risk tier, confidence, named flags/reasons, and a tenant-scoped device handle.
Collection cadence: cached and configurable; checkOnce() respects the applicable interval.
Decision owner: your route-specific policy; Noxtica supplies evidence and eligible enforcement surfaces.
Availability: plan, contract, role, tenant/domain configuration, client support, quota, and legal-basis gates can apply.
Performance: measure your selected client, configuration, geography, network, and cache mix; this page makes no universal latency or availability commitment.

Support

Access, provisioning, commercial eligibility, or technical support: Contact us.
Before opening a ticket: include the tenant and domain, timestamp, customer-visible symptom, relevant request or device handle, and whether the result was cached. Do not send Server API secrets or unnecessary personal data.
Capability question: link the applicable capability family and note whether its page or setting is visible in Backoffice.