Exact origin allowlist
Each public site key works only on the HTTPS origins you register. Wildcard and null origins are rejected.
PeopleDat browser widget
Give forms a useful signal without making them brittle.
Run a Quick verification from an approved HTTPS origin. New dashboard widgets block undeliverable results by default; with that policy, risky and unknown results warn and allow submission. Outages and credit problems always fail open.
Custom feedback example
Looks deliverable
Built from the peopledat:result event. The base snippet does not render this positive state.
<form action="/join" method="post" data-peopledat>
<label for="work-email">Work email</label>
<input id="work-email" name="email" type="email" required>
<button type="submit">Continue</button>
</form>
<script
src="https://peopledat.com/widget/v1.js"
data-site-key="pdw_…"
defer>
</script>Hard exposure limits
Per-IP, per-widget, and per-workspace limits plus a daily credit cap contain browser-key abuse.
Fail-open by design
Timeouts, outages, unknowns, inconclusive results, and exhausted credits never prevent a visitor from submitting.
Important: browser site keys and Origin headers are not secrets. Use the widget as a helpful signal, keep server-side validation for important workflows, and set a daily credit cap you are comfortable exposing.