ShieldForm: bot detection API for web forms
A 4.5 KB browser SDK records how the visitor used the page; POST /verify turns that into a 0-100 score and an allow, challenge or block decision. No CAPTCHA, nothing shown to the visitor.
AWS Marketplace subscription (X-API-Key) · or $0.005 per call with x402 on Base or Solana · only successful calls are billed
How it works
1. Load the SDK on the form page. 2. On submit, send ShieldForm.getToken() to your server. 3. Your server calls POST /verify and acts on decision.
<script src="https://shieldform.waltsoft.net/sdk/v1/sf.js" data-site-key="YOUR_SITE"></script>curl -X POST "https://shieldform.waltsoft.net/verify" \
-H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
-d '{"token": "TOKEN_FROM_THE_SDK", "email": "jane@example.com"}'
{"score": 100, "decision": "allow", "requestId": "3f2a9c1d7b4e", "token_valid": true}Scoring
Start at 100 and subtract for bot-like behavior: under 3 s on the page, no mouse or touch, no keystrokes, no field focus, no scroll after 5 s, keystrokes under 30 ms apart, a form filled in under 1 s, a fingerprint seen more than 5 times whose last score was under 40, an email local part with 4+ dots or 7+ consonants in a row. 70 or more = allow, 40-69 = challenge, under 40 = block. No usable token (the SDK did not run: a content blocker, a stale cache or a bot) gets the neutral score 50 (challenge) with token_valid: false.
Token format (for agents and server-side callers)
The token is base64 of JSON: {"s": site, "t": ms, "sg": {m, k, kt, f, sc, to, v, tp, fi}, "fp": fingerprint} where m = mouse moves, k = keystrokes, kt = average ms between keystrokes, f = form-field focus events, sc = scroll depth (%), to = touches, v = tab switches, tp = ms on page, fi = ms since the first field was used.
Use ShieldForm from an AI agent
MCP (Amazon Bedrock AgentCore Gateway, no connection header; pass api_key in each call):
https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp
shieldform___verifySubmission(api_key, token, email)— score a form submission from its SDK token; email is optional
A2A (Agent2Agent 0.3, JSON-RPC message/send): agent card https://shieldform.waltsoft.net/.well-known/agent-card.json
REST: OpenAPI 3 schema · agents.md · llms.txt
Buy on AWS Marketplace
Subscribe with your AWS account and pay on your AWS bill: your API key is delivered to your AWS Secrets Manager. Find Waltsoft ShieldForm on AWS Marketplace.
FAQ
What does ShieldForm return?
POST /verify returns score (0-100, higher is more human), decision (allow at 70 or more, challenge at 40-69, block below 40), a requestId and token_valid, which is false when no usable SDK token was sent (the score is then a neutral 50).
Where does the token come from?
The ShieldForm browser SDK (/sdk/v1/sf.js) counts mouse moves, keystrokes and their average spacing, field focus, scroll depth, touches, tab switches, time on page and time since the first field was used, and getToken() returns them base64-encoded with a lightweight browser fingerprint.
What happens if no token is sent?
The submission gets the neutral score 50 (challenge) with token_valid false: the SDK may have been blocked by a content blocker or a stale cache, so a missing token alone is not treated as a bot. Decide what to do with a challenge yourself, for example a confirmation email.
Does ShieldForm use a CAPTCHA?
No. Nothing is shown to the visitor; the score comes only from how the page was used before the form was submitted.
How do I pay?
Subscribe on AWS Marketplace and send your mp_ key as the X-API-Key header, or pay $0.005 per call with x402 (USDC on Base or Solana) and no key. Only successful calls are billed.
Can an AI agent call it?
Yes: through the Amazon Bedrock AgentCore Gateway as the MCP tool shieldform___verifySubmission, through A2A with the agent card at /.well-known/agent-card.json, or with the OpenAPI schema at /openapi.json.