Server SDKs

Browser SDKs collect. Server SDKs verify.

Step	Who	Key	Typical JSON
Collect	Browser / Android	`kv_pk_…`	Response includes `event_id`
Verify	Your backend	`kv_sk_…`	Request `{ "event_id": "…" }` → decision JSON

verify is billable. Never call it from the browser.

Runtime	Package	Install
Node 18+	`@keverdjs/node`	`npm install @keverdjs/node`
Python 3.9+	`keverd`	`pip install keverd`
PHP 8.1+	`keverd/keverd`	`composer require keverd/keverd`

Flow

1. Browser collects (public key) and gets JSON including event_id (React maps this to requestId). 2. Browser sends that id to your API, for example:

{
  "eventId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "email": "user@example.com"
}

3. Your server verifies (secret key):

{
  "event_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}

4. Enforce the returned action (allow | soft_challenge | hard_challenge | block). The full response also includes reasons, smart_signals, location, ip_info, and device_history — see POST /v2/verify. Webhooks are optional fan-out after verify (envelope JSON).