Improve form quality without turning email checks into an outage.

1. 1

   Create a named widget

   Use one widget per site or risk boundary so usage and revocation stay attributable.
2. 2

   Add exact HTTPS origins

   Enter 1–20 complete origins such as https://www.example.com. Wildcards, paths, query strings, URL credentials, null, and HTTP are rejected.
3. 3

   Set a daily hard credit cap

   Choose 1–50,000 credits. Start low, observe legitimate volume, then raise deliberately.
4. 4

   Choose blocking categories

   The dashboard starts with undeliverable selected. With that default, risky and unknown results warn and allow submission. You may remove that block or explicitly add invalid syntax, disposable, spam-trap, or disabled results.
5. 5

   Copy the public site key

   A key starts with pdw_. It is designed to be visible in browser code and is not a secret.

<form action="/join" method="post" data-peopledat>
  <label for="work-email">Work email</label>
  <input id="work-email" name="email" type="email" required>
  <button type="submit">Continue</button>
</form>

<script
  src="https://peopledat.com/widget/v1.js"
  data-site-key="pdw_REPLACE_WITH_YOUR_SITE_KEY"
  defer>
</script>

• Put data-peopledat on each form you want automatically checked.
• Use an input[type=email] or input[name=email].
• Keep your normal form action and server-side validation.
• Load the script with defer so markup is available when it binds.
• Use data-site-key on a form to override the script’s default key for that form.
• The script adds subtle “Checked by PeopleDat” attribution when enabled.
• The base binding does not render positive or warning result UI. Add your own listener if you want visible feedback.

Every completed check emits a bubbling peopledat:result event before an allowed form is resubmitted. The markup and listener below are custom feedback; the base snippet does not render them for you.

<p id="email-feedback" role="status" aria-live="polite"></p>

<script>
  const form = document.querySelector('[data-peopledat]')
  const feedback = document.querySelector('#email-feedback')

  form.addEventListener('peopledat:result', (event) => {
    const { allow, status, warning } = event.detail

    feedback.dataset.state = !allow
      ? 'blocked'
      : status === 'deliverable'
        ? 'positive'
        : warning
          ? 'warning'
          : 'neutral'

    feedback.textContent = !allow
      ? 'Please use a deliverable email address.'
      : status === 'deliverable'
        ? 'Looks deliverable.'
        : warning
          ? 'We could not confirm this address, but you can continue.'
          : ''
  })
</script>

With the dashboard default, risky results emit review with allow: true and warning: true; unknown results emit unavailable with the same allow/warning flags. A default-blocked undeliverable result emits invalid with allow: false.

The browser receives coarse reasons by design. It never receives provider internals, cache details, raw API credentials, or other workspace data.

The loaded script exposes an immutable window.PeopleDat object with version, verify, and bind.

const form = document.querySelector('#newsletter-form')
window.PeopleDat.bind(form)

const result = await window.PeopleDat.verify({
  siteKey: 'pdw_REPLACE_WITH_YOUR_SITE_KEY',
  email: '[email protected]',
  requestId: crypto.randomUUID()
})

if (result.status === 'unavailable') {
  // Fail open: continue your normal workflow.
}

Use a unique request ID for each visitor action. The automatic form binding creates one for you and prevents duplicate pending checks or resubmission loops.

• Treat the site key as public; never put a pd_live_… API key in browser code.
• Keep normal server-side validation, abuse controls, consent checks, and authorization.
• Use the widget only as a point-in-time email-quality signal.
• Add https://peopledat.com to both script-src and connect-src in a strict Content Security Policy.
• Do not send the result as proof of identity or mailbox ownership.
• Monitor usage and pause/revoke a widget that shows unexpected volume.

Content-Security-Policy:
  script-src 'self' https://peopledat.com;
  connect-src 'self' https://peopledat.com;

Timeouts, PeopleDat outages, provider failures, unknown/excluded results, exhausted credits, daily-cap denials, and other inconclusive states return an allowed unavailable result. The SDK also catches network, CORS, parsing, and abort errors and returns an allowed response.

PeopleDat uses a shorter server deadline than the browser timeout. If work completes too late to influence the visitor, the interaction is reconciled to zero billed credits.