Rules for every integration
- Browsers use the SDK or Hosted Verify. Never put secrets or hand-built auth headers in browser code. Proxy through your server instead.
- Servers run gate checks, raw HTTP, and anything that needs a credential.
- Access keys (
npk_*) belong on servers and in CI only. Never use a wallet private key as an MCP credential. Access keys 402responses carry a quote. Pay per call with x402, or add credits and retry.- Proof IDs and URLs come from responses. Never construct or guess one.
Machine-readable exports
This docs site also serves a search-only MCP endpoint at
https://docs.proofable.me/mcp. It searches these pages. Your profile, proofs, and agents live at https://mcp.proofable.me/mcp.
Sections
MCP
Tools, sign-in, and discovery.
JavaScript SDK
Client, gates, agents, widgets, and CLI.
HTTP API
Endpoints, authentication, errors, and limits.
Verifier catalog
Every check and its inputs.
