Introduction

Before you begin

• Create your account in the Centinel Analytica dashboard.
• You'll need:
  • your site key (public, used by the browser script)
  • your secret key (server-only, used for /validate)

How it works

Centinel has three parts:

• Server validation (required): your backend, or a platform integration, calls the validation API for each protected request and acts on the decision (allow, block, or redirect). The validator issues the _centinel session cookie, and your response sets it.
• Policy rules: rules select bot detection and actions for matching requests. The dashboard's default rule enforces nothing, because the validator skips it. Add and verify an explicit matching rule before you rely on a policy action.
• Browser script (optional): collects browser and network signals that server-side data alone cannot see, and mirrors the _centinel cookie. Detection works without it, with a smaller signal set.

Next steps

New to the decisions and block reasons in the dashboard? The Glossary defines them.

Getting help

Contact support with:

• the URL you're protecting
• a sample /validate request payload (redact secrets)
• the decision you received and any crawler metadata (if enabled)