Reference

Test keys and feedback

Use fixed results in CI. Report fraud and false positives after verification.

Test keys

These public keys return fixed results in any browser.

Site key	Secret	verdict	decision
`test-allow`	`test-allow-secret`	human	allow
`test-bot`	`test-bot-secret`	bot	block
`test-limit`	`test-limit-secret`	human	limit
`test-shadow`	`test-shadow-secret`	bot	shadow

{ "success": true, "verdict": "human", "decision": "allow", "test": true, "ref": "ev_test", ... }

CI notes

Any origin works. Nothing is stored or billed.
Tokens stay single-site: a test token fails with site-mismatch on a production secret, and a production token fails on a test secret.
Tokens can be verified more than once and expire after 5 minutes.
Fail the build if production config contains test- keys, or if a production response has "test": true.
Set keys through environment variables, such as NOLGARD_SITE_KEY=test-allow and NOLGARD_SECRET=test-allow-secret.

Feedback API

Report fraud or a false positive with the ref from /v1/verify.

POST https://nolgard.com/v1/feedback
{ "secret": "sk_…", "ref": "ev_k2j9", "outcome": "fraud" }

200 { "ok": true, "ref": "ev_k2j9", "outcome": "fraud", "applied": true }

outcome	Effect for 30 days, this site only
`fraud`	Reports the device and email domain, never the network. Shared offices and mobile carriers are unaffected. Later verifies from the reported device or domain get `decision: limit` (reason `reported_fraud`).
`legit`	Lifts repeat limits for that device.

The Human and Bot buttons on a dashboard event submit the same feedback. Clear the label to withdraw it.
Free mail domains such as gmail.com are never reported.
400 invalid-input, 401 invalid-secret, 404 not-found for unknown refs or refs from another site, 429 rate-limited above 60 per minute per site.