Security center

Secure beta logic without frontend-only trust

Critical access logic should not live only on the client. AdProof separates public SDK keys from secret server-side verification keys.

Production readiness

Allowed domains configured Secret key stored on backend CSP checked Kill switch tested

Public key

Safe for frontend use. It identifies the project and loads allowed SDK settings.

Secret key

Stored only on the customer backend. It is used for strict server-to-server verification.

Kill switch

Emergency rollback for safely disabling checks while you fix a production issue.

Server verify flow

The frontend should not decide by itself whether premium content is shown in the strict flow. It reports a signal and the customer backend verifies access.

POST /api/verify
Authorization: Bearer sk_live_xxx
{
  "projectId": "prj_123",
  "sessionId": "sess_456",
  "pageUrl": "https://client.com/article"
}

Security notes

Never expose secret keys in browser code.
Restrict public keys by allowed domains.
Rate-limit event and verify endpoints.
Keep audit logs for admin actions.
Test the strict flow on staging before production rollout.