Python integration
Python can be protected completely — with no package and no dependency. The check is a single HTTPS call.
We do not ship a Python SDK. That is a statement about our packaging, not about your protection: what the SDKs do, the call below does with the standard library.
1. Add the widget
The script measures behaviour in the browser and puts a hidden field into every form. Add it once to the head of your pages.
<!-- In <head> or before </body> of every page with a form -->
<script src="https://api.silentshield.io/client.js?k=YOUR_API_KEY" defer></script>2. Verify on your server
On submit, read the hidden field and ask us before you accept the submission. Without this step the browser decides alone — and a bot that runs no JavaScript walks straight past it.
# No package required — the check is one HTTPS POST.
# Standard library only: nothing to install, nothing to keep updated.
import json
import os
import urllib.error
import urllib.request
VERIFY_URL = "https://api.silentshield.io/api/v1/captcha/verify-nonce"
API_KEY = os.environ["SILENTSHIELD_KEY"] # never hard-code it
def is_human(nonce: str) -> bool:
"""Ask SilentShield about one submission.
The hidden field `behavior_nonce` is injected by client.js;
read it from the posted form and hand it over unchanged.
"""
if not nonce:
return False
request = urllib.request.Request(
VERIFY_URL,
data=json.dumps({"nonce": nonce}).encode(),
headers={
"Content-Type": "application/json",
"X-Api-Key": API_KEY,
# Tells us which integration is in use, exactly like the SDKs do.
"X-SS-SDK": "python-inline/1",
},
method="POST",
)
try:
with urllib.request.urlopen(request, timeout=5) as response:
data = json.loads(response.read())
except (urllib.error.URLError, TimeoutError, ValueError):
# We are unreachable. Let the visitor through: a real customer turned
# away costs more than a bot let in. Flip this to False only if you
# would rather lose submissions than accept one unchecked.
return True
return (
data.get("ok") is True
and data.get("verdict") == "human"
and data.get("confidence", 0) >= 0.7
)
# --- Flask ---------------------------------------------------------------
# @app.post("/contact")
# def contact():
# if not is_human(request.form.get("behavior_nonce", "")):
# abort(400, "Please submit the form again.")
# ...
# --- Django --------------------------------------------------------------
# def contact(request):
# if not is_human(request.POST.get("behavior_nonce", "")):
# return HttpResponseBadRequest("Please submit the form again.")
# ...
# --- FastAPI -------------------------------------------------------------
# @app.post("/contact")
# async def contact(behavior_nonce: str = Form("")):
# if not is_human(behavior_nonce):
# raise HTTPException(status_code=400, detail="Please submit the form again.")
# ...Flask, Django and FastAPI
The function above is framework-independent. The three call sites are listed as comments at the end of the snippet: Flask reads the form dictionary, Django the POST data, FastAPI a form parameter.
When we are unreachable
The snippet lets the visitor through. A customer turned away by mistake costs more than a bot let in. If you want the opposite, return false in the error branch — then an outage costs you submissions.
AI agents
Report agent sightings with the same pattern against the telemetry endpoint: one POST, the same header.
Enforcing the rules locally is not possible from Python — it verifies an Ed25519 signature over a rule bundle. Put the enforcer in front of your application as a sidecar, or use the Cloudflare Worker.