Noxtica Documentation

Use these docs to move from an activated account to a measured, reviewable policy. Noxtica provides browser and device intelligence, calibrated risk, bot and agent controls, and operator workflows; your team chooses where those outputs influence a customer journey.

Availability is account-specific. Backoffice visibility, API scopes, module status, and your service agreement determine which surfaces you can use. A capability described in the directory may still require entitlement, tenant or domain activation, a supported client, or privacy/legal review.

Choose a path by task

What is Noxtica?

Noxtica collects eligible browser, device, network, and interaction context, checks the available evidence for consistency, and returns a calibrated assessment. A result can help you recognize a returning browser installation, identify suspicious automation or infrastructure, verify supported agent identities, prioritize an investigation, or apply a route-specific policy.

The result is not proof that a visitor is a particular person, a guaranteed bot verdict, or a replacement for authentication. Read risk, confidence, and reasons together and combine them with the value and reversibility of the action your application is considering.

Key Capabilities

• Device and browser intelligence: receive a tenant-scoped device handle and a calibrated assessment from an activated collector.
• Bot, abuse, and network defense: combine automation, consistency, infrastructure, and interaction reason families without making one signal decisive.
• Risk and decisioning: use score, five-level risk tier, confidence, and reasons in customer-owned allow, observe, challenge, review, or block policies.
• Agent identity and control: apply separate trust policies to supported signed agents and unknown automation when the module is enabled.
• Investigation and operations: review device records, trends, policy outcomes, audit history, alerts, and eligible exports in Backoffice.
• Integrations: consume browser events, scoped backend reads, SDKs, event delivery, exports, and eligible read-only MCP access.

See the Customer Capability Reference for every public family, where it appears, what it produces, and what must be enabled.

Platform Components

Quick Start

1. Get Your Site Key

Request access through Contact. After your account is provisioned, sign in to Backoffice, add the exact production or staging origin under Domains, and copy its Site Key. Keep environments separate; a Site Key is public but origin-bound.

2. Add the Collector

The collector is two scripts: the core runs on every page without waiting for consent, and the extensions (device recognition, analytics, replay, behavioral signals) load only after the visitor consents. Place the synchronous replay preloader first in <head>, followed by the asynchronous core:

<script
	src="https://collect.noxtica.com/collector/noxtica-recorder-head.js"
	crossorigin="anonymous"
	data-cfasync="false"
></script>
<script
	src="https://collect.noxtica.com/collector/noxtica-collector-core.js"
	data-site-key="pk_prod_your_site_key_here"
	data-auto-init
	data-auto-check-once
	data-extensions="auto"
	async
></script>

With data-extensions="auto", the core loads the extensions itself: right away when your domain’s consent mode is not_required (the default), and on the first granted category in the consent-gated modes. Set the mode, and the login, checkout, or sign-up steps that keep a minimal security check without consent, under Backoffice → Integrations & API → Script & Consent; Browser Runtime covers the consent API, cookie mode, and protected actions.

The combined script https://collect.noxtica.com/collector/noxtica.js is legacy: still supported and unchanged, but it cannot separate consent-free from consent-gated collection. Migrate by replacing it with the core tag above.

The preloader buffers a bounded early window in memory and has no transport. The asynchronous collector drains it only after the configured replay admission checks allow capture; otherwise the queue is discarded. Sites that do not use replay may omit it. Load it synchronously (never async, defer, or type="module"); data-cfasync="false" stops Cloudflare Rocket Loader from deferring it.

The URLs above always serve the current build, so the tags never need updating.

Pinned version with Subresource Integrity (optional)

Use this only if your security policy requires an integrity attribute. A pinned tag references one exact content-hashed build. When the collector ships a new build, that file stops being served and the pinned tag must be replaced, so never copy a pinned hash from a document, including this one.

For the preloader, copy the current pinned tag from Backoffice → Session Replay → Install & usage, or build it from the collector’s live manifest at https://collect.noxtica.com/collector/asset-manifest.json: use assets["noxtica-recorder-head.js"] as the file name under https://collect.noxtica.com/collector/ and integrity["noxtica-recorder-head.js"] as the integrity value, keeping crossorigin="anonymous" and data-cfasync="false". For the core and extensions, copy the pinned tags from Backoffice → Integrations & API → Script & Consent (manifest keys noxtica-collector-core.js and noxtica-collector-extensions.js); a pinned core loads the extensions with their own integrity hash.

Content Security Policy

If you use a content-security-policy, add only the sources and execution permissions required by the integration mode you selected. The current reference configuration is maintained in Getting Started → Content Security Policy. Test your policy in a non-production domain and monitor noxtica:error; a restricted policy can reduce available protection or prevent collection.

3. Receive Risk Scores

Listen for the documented result event after successful collection or a cache hit:

document.addEventListener('noxtica:collected', (event) => {
	const { fingerprintId, score, risk_level, confidence, flags, fromCache } = event.detail;

	// Send the device handle to your backend with the customer action.
	// Treat score, confidence, and flags as policy inputs—not an identity verdict.
});

Do not put a secret Server API key in this handler. Use the browser result to shape reversible experience choices or send its device handle to your backend for a trusted lookup.

4. Server-side Lookups (Optional)

Create a Server API key in Backoffice → API Config, select the narrowest required scope, save the secret when shown, and call the supported endpoint from your backend:

curl -H "Authorization: Bearer sk_prod_your_api_key" \
  "https://collect.noxtica.com/v1/device/DEVICE_ID"

Handle 401, 403, 404, and 429 explicitly. A missing or expired device should follow your unknown path rather than being treated as safe or malicious. See Backend Integration for response fields, caching, and error handling.

Guides

Integrate

• Getting Started: account prerequisites, domains, collector installation, modes, parameters, CSP, consent-sensitive options, and response shape.
• Browser Runtime: lifecycle, browser events, caching, force refresh, cross-tab behavior, supported clients, and troubleshooting.
• Backend Integration: scoped server keys, trusted lookups, errors, rate limits, and backend decision patterns.

Decide and investigate

• Detection Signals: what each evidence layer contributes and how missing evidence affects confidence.
• Threat Categories: public reason families, appropriate uses, and common false-positive boundaries.
• Why Calibration, Not Verdicts: map risk and confidence to route-specific policy.
• Use Cases: reference patterns for marketplaces, financial services, identity-sensitive flows, and agent governance.

Operate and govern

• Customer Capability Reference: the complete customer-facing capability directory with surfaces, outputs, eligibility, and limits.
• Impact by Audience: responsibilities and outcomes for security teams, platforms, end users, and agent owners.
• Platform Overview: the reference version of the home-page sections, from customer value and the platform tour to capability families, principles, replay context, AI guardrails, and next steps.
• Pricing Reference: the explanatory text behind the pricing page — billing disclosures, comparison dimensions, add-ons, KYC and metered-module notes, estimator definitions, and commercial FAQ.
• Engineering Principles: the operational review checks behind defensible decisions.
• Concepts & Glossary: shared terms for device intelligence, agent controls, browser security, MCP, and the assistant.

Risk Levels

Every assessment can include a numeric score and one of five plain-language levels. The fixed ranges below describe the current public response contract; they are not universal action thresholds.

Confidence answers a separate question: how much usable evidence supported the assessment. Low confidence should normally move a decision toward defer, collect more evidence, or a reversible challenge—not toward an irreversible block.

Dashboard

Manage your activated account in Backoffice. Start with the selected tenant and domain, then use Analytics for population behavior, Fingerprints for individual records, Risk Actions for policy outcomes, and Usage for current limits. The pages you see depend on your role and enabled modules.

At a Glance

• Integration model: domain-bound browser Site Key plus optional scoped server credentials.
• Primary output: score, five-level risk tier, confidence, named flags/reasons, and a tenant-scoped device handle.
• Collection cadence: cached and configurable; checkOnce() respects the applicable interval.
• Decision owner: your route-specific policy; Noxtica supplies evidence and eligible enforcement surfaces.
• Availability: plan, contract, role, tenant/domain configuration, client support, quota, and legal-basis gates can apply.
• Performance: measure your selected client, configuration, geography, network, and cache mix; this page makes no universal latency or availability commitment.

Support

• Access, provisioning, commercial eligibility, or technical support: Contact us.
• Before opening a ticket: include the tenant and domain, timestamp, customer-visible symptom, relevant request or device handle, and whether the result was cached. Do not send Server API secrets or unnecessary personal data.
• Capability question: link the applicable capability family and note whether its page or setting is visible in Backoffice.