Skip to main content
A link has two sides. Your organization sees it in the registry in the BotShield Console. The person sees it under Accounts in the BotShield app. Either side can end it, and your server can end it too, with its API key. See Server API.

The Verified Accounts page

In the BotShield Console, open Verified Accounts in the sidebar. The page has four tabs: Set up Link with BotShield ID, in the page header, opens your surfaces: each one a page with one site key and its switch. From there you add a surface. Use the Development and Production toggle at the top of the page to choose the environment. A link belongs to the environment of the key its confirmation ran under.

The registry

The registry is a list of accounts, not of people. A row never shows an email address, a name, a device or another platform.

Columns

Totals

The period is Last 30 days, 90 days or All time. The filters All, Linked and Unlinked choose which rows the table shows.

Search by your user reference

Type one of your own account IDs, the value you pass as platform-user-ref, into Search by your user ref (exact). The match is exact. BotShield hashes what you type and compares it with the stored hash, then shows the row with its handle. Your reference is never stored in a readable form and never shown back to you. This is how you find the handle for one of your users.

Export CSV

Export CSV downloads the rows that are loaded in the table, with the columns Handle, Linked and Status.

Revoke

Select Revoke on an active row to end the link. The Console asks Unlink this account? before it continues. In Production, you confirm with your Developer passkey. Only an organization admin can revoke. Members can read and export. After a revoke: Revoke an account when:
  • The user deleted or closed the account on your side.
  • The account changed hands.
  • A sign-in detail changed, such as a password reset you did not expect, and you want the human to confirm again.
A revoke that finds no active link succeeds and changes nothing. A revoke ends only the link in the environment you are viewing. To revoke from code, for example when a user changes their password, call POST /secured-accounts/revoke with your API key. It has the same effects, with reason: "credential_changed" when a sign-in detail changed. See Server API.

What the person controls

The person manages their side in the BotShield app, under Accounts. A person cannot link an account again from the app alone. The request always starts on your page, where your sign-in shows which account it is. The app confirms the human. Your page identifies the account. If the person deletes their BotShield account, every platform they linked an account on receives account.unlinked with by: "human". An unlinked account is an ordinary account again:
  • A gate pass on it reports trusted: false.
  • The widget shows the chip on the next visit, when the offer is on.
  • Linking it again sends account.secured and gate.human_verified with first_time: true. The handle is the same if the same person links it.
Keep your own record in step by handling account.unlinked. See Staying in sync.