Integration guide

Sign in with Google or an email verification code, then create a key in Account. Copy the key when it is shown: only its hash is saved. Existing users can link a legacy key using its private management token.

Server-side check

POST /api/v1/check
Content-Type: application/json
x-api-key: YOUR_API_KEY

{"text":"Can you quote this project?","email":"visitor@example.com"}

Responses include verdict (allow, block, review), score, reason, engine (jev or rules), execution_time_ms and quota_remaining. Scores from rules are heuristic estimates. Confidence is present only for Jev. Treat review as uncertain, not an automatic block.

400: invalid input. 401: missing key. 403: invalid key. 429: quota exhausted. 503: unavailable. Maximum message size: 10,000 characters. Provider failure falls back to rules. Decide whether your server should allow, queue or reject when the service itself is unavailable.

Optional browser helper

<form data-formshield> ... </form>
<script src="https://jevshield.com/shield.js" data-key="YOUR_API_KEY"></script>

The helper checks only explicitly marked forms, sends message, email and name fields, and allows submission after a network failure or 6-second timeout. It is bypassable and exposes the API key to visitors. Use server-side checks for enforcement and to keep the key private. Test AJAX form plugins before enabling it.

WordPress

Install the ZIP, open Settings → FormShield AI, and enter your API key and full HTTPS /api/v1/check endpoint. The plugin transmits relevant submission fields only after configuration. Document this in your privacy notice. Integrations require validation against your installed plugin versions before production use.