# ShieldForm: full reference

> Bot detection for web forms from browser behavior. Score 0-100 per submission, no CAPTCHA.

## POST /verify
- URL: https://shieldform.waltsoft.net/verify
- Auth: X-API-Key: mp_... (AWS Marketplace) or Authorization: Bearer mp_...; or x402 ($0.005, USDC on Base or Solana: PAYMENT-SIGNATURE header); or x-sf-key with siteKey for sites registered directly with Waltsoft
- Body (JSON object): token (string, from the SDK), email (string, optional), siteKey (string, optional)
- 200: {"score": 0-100, "decision": "allow|challenge|block", "requestId": "12 hex chars", "token_valid": true|false}
- 400 body is not a JSON object or a field is not a string · 401 invalid or inactive key · 402 no key: x402 challenge · 503 key service down. Errors are never billed.

## Token
base64 of JSON {"s": site, "t": ms, "sg": {...}, "fp": fingerprint}. Signals: m = mouse moves, k = keystrokes, kt = average ms between keystrokes, f = form-field focus events, sc = scroll depth (%), to = touches, v = tab switches, tp = ms on page, fi = ms since the first field was used.
Example: eyJzIjogIiIsICJ0IjogMTc2MDU1MDAwMDAwMCwgInNnIjogeyJtIjogNDIsICJzYyI6IDM1LCAiayI6IDI0LCAia3QiOiAxNDAsICJmIjogMywgInRvIjogMCwgInYiOiAwLCAidHAiOiA5MjAwLCAiZmkiOiA1MTAwfSwgImZwIjogImszajl4MiJ9

## Scoring
Start at 100. -40 under 3 s on the page; -25 no mouse and no touch; -15 no keystrokes; -20 no field focus; -10 no scroll after 5 s; -15 keystrokes under 30 ms apart on average; -15 the form filled in under 1 s; -30 a fingerprint seen more than 5 times whose most recent score was under 40; email: -15 four or more dots, -10 seven or more consonants in a row. Clamped to 0-100. No token or no signals: the neutral 50.
Decision: 70+ allow, 40-69 challenge, under 40 block.

## Free routes
GET / (this site), /llms.txt, /llms-full.txt, /agents.md, /openapi.json, /.well-known/agent-card.json, /sdk/v1/sf.js (the browser SDK), /health, /.well-known/x402

## Agent protocols
- MCP: https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp tool shieldform___verifySubmission(api_key, token, email)
- A2A: https://shieldform.waltsoft.net/.well-known/agent-card.json, JSON-RPC https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/a2a-gw/shieldform

## x402 details
Asset USDC (6 decimals), amount 5000 = $0.005. Base payTo 0x318A4B4764eb37c3FCBcE434713128143815FD57; Solana payTo GsKr5q9TmiJQcEgUpBp2X6SmvSg3dnXuw2uxYJxgPTk8 (fee payer from the 402 challenge).

## Provider
Waltsoft · https://waltsoft.net · 16 APIs for AI agents