POST /v1/projects/{project}/scoring
Enable bot scoring on a project and mint its site key and private key. The private key is returned once.
curl -X POST https://api.botect.ai/v1/projects/123/scoring \
-H "Authorization: Bearer YOUR_ACCOUNT_TOKEN"
const res = await fetch('https://api.botect.ai/v1/projects/123/scoring', {
method: 'POST',
headers: { Authorization: `Bearer ${process.env.BOTECT_TOKEN}` },
});
const { site_key, private_key } = await res.json();
import os, requests
r = requests.post(
"https://api.botect.ai/v1/projects/123/scoring",
headers={"Authorization": f"Bearer {os.environ['BOTECT_TOKEN']}"},
)
keys = r.json()
{
"site_key": "pk_2bX…",
"private_key": "sk_9aQ…",
"bot_settings": {
"allow_verified": true,
"protect_static": true,
"block_definite": false,
"challenge_likely": false
},
"likely_bot_threshold": 30
}
{
"site_key": "pk_2bX…",
"private_key": null,
"bot_settings": {
"allow_verified": true,
"protect_static": true,
"block_definite": false,
"challenge_likely": false
},
"likely_bot_threshold": 30
}
Turns scoring on for a project and mints the data-plane credentials: a site key (pk_…, public) and a private key (sk_…, secret). Idempotent — calling it again while already enabled returns the existing site key and a null private key (Botect only stores the private key's hash, so it can't re-show it).
POST https://api.botect.ai/v1/projects/{project}/scoring
Authentication
Account API token via Authorization: Bearer <token>. The project must belong to the token's account. Reachable without an active subscription, so you can configure a project before subscribing. See Authentication.
Path parameters
The project ID to enable scoring on.
Example
Response fields
The public site key (pk_…) for ingest.
The secret private key (sk_…) for verdict reads — returned only on first enablement. null if scoring was already enabled; rotate to get a new one.
The project's enforcement toggles (observe-first defaults). See Score bands.
The bot/human boundary T (default 30).
Store the private_key immediately — it is shown once and cannot be recovered, only rotated.
Errors
| Status | code | When |
|---|---|---|
401 | UNAUTHENTICATED | Missing / bad account token |
403 | — | Project does not belong to the token's account |