Portal guide | Volance

First five minutes. Create an account, then: Setup (name your project, add allowed origins) → Test (run one consented test) → Setup (copy the secret key to your backend) → Overview (watch live traffic arrive).

What is a project?

A project is one workspace you protect: a website, a set of pages, or a single API endpoint. Every project owns its own key pair, allowed origins, policy, saved sessions, usage, members, and audit trail. Your account starts with one Free project; Pro includes five and Business twenty-five.

Projects are identified by a pk_ public key. The key pair is created with the project — you never paste a key to create one.

Keys: public and secret

pk_… public key: Identifies the project. It may live in page code; it can request a session manifest and nothing else.
sk_… secret key: Authenticates scoring from your backend only. Revealing it requires re-authentication (your password, or Google if that is how you signed in), it is shown for 60 seconds, and rotating it invalidates the old pair.

Never put a secret key in a browser. The collector sends evidence to your own server; your server calls Volance with the secret key. The portal's Test tab is the one place the browser scores directly, and it uses your signed-in session instead of a key.

The Test tab: a consented scratchpad

The test area runs the reviewed collector inside one page element. Collection starts only after you tick the consent box, captures only keydown/scroll timing plus a webdriver flag and dwell time, and stops when you leave the tab. Saved tests are kept for review, are never billable, and never count towards your plan.

Below the test area, Developer test results summarise your tests: totals, the human/agent split, average score, and one bar per day (or per hour for the 24-hour range) counting tests saved in that window.

Overview: live API traffic

Overview shows live traffic — scores your own backend requested for real visitors. Developer tests are deliberately excluded here; they live on the Test tab.

Live traffic statistics: How many calls arrived in the selected range, the human/agent split, and the average human-likeness score.
Live traffic over time: One bar per day — or per hour when you pick the 24-hour range — counting calls saved in that window. “All time” runs from the workspace creation date. Hover any panel title for the same explanation.
By classification / By verdict / By page: How traffic split across the classifier labels, the contract verdict bands, and the page paths you scored.

Ranges apply to every panel on the page: 24 hours, 7 days, 30 days, or all time.

Sessions: what a request actually looked like

Every saved score is a session. Filter by source (live calls or developer tests), by verdict, or search by page, score, or id; sort by newest, oldest, or highest score; and copy the filtered set as CSV.

Opening a session shows the full evidence:

score: 0–100 human-likeness estimate. An estimate, not proof of identity.
classification.label: human, agent, or bot, with the probabilities behind it.
verdict: The contract band for the score: human ≥ 80, likely human ≥ 70, suspicious agent ≥ 40, bot below 40.
action: The recommendation: allow, flag, or block. In monitor mode nothing is enforced; your server decides.
signals: Every check that ran, whether it fired, and its reading. Hover any check name for what it means.
consistency: Client signals cross-checked against each other; mismatches are strong evidence of a scripted or faked environment.
overrides: Hard rules that capped the score, such as an exposed automation flag or a spoofed disclosure header.
cascade: When a score lands mid-band, Volance suggests extra decoy checks to gather more evidence before you decide.
requestId: The id for that score, useful when comparing portal evidence with your own logs.

Usage and plans

Plans meter customer scores — one per scoring call your backend makes. Free includes 10,000 a month; Pro 250,000; Business is set up with you directly. Developer tests are never billable.

At the monthly cap, Free pauses new scores until the quota resets; Pro and Business keep scoring but pause enforcement and flag the workspace, so your traffic is never dropped. Plan changes are requested in the portal and applied by our team while card checkout is rolled out.

Members and roles

Pro and Business include named users: owners manage the plan and people, admins manage keys and settings, and members have read-only visibility. Free covers a single named user. Invitations are sent by email; the person signs up with that address and joins the workspace automatically.

Audit

An action trail for the workspace: provisioning, key reveals, rotations and revocations, project changes, invitations, role changes, plan requests, and session deletions — with who did it and when. The Volance team sees the same trail across workspaces for support.

Installing the collector

The Setup tab shows the install snippet. The reviewed module lives at https://app.volance.com/trace.js, has no side effects, and never auto-starts:

trace.jsInstall

<script type="module">
  import { createCollector } from 'https://app.volance.com/trace.js';

  const collector = createCollector({ target: document.querySelector('#trace-area') });
  // Only after the visitor opts in:
  collector.start({ consent: true });
  // Send collector.stop() evidence to YOUR backend,
  // which relays it to Volance with your sk_ secret.
</script>

Browser requests for session manifests are checked against the project's allowed origins whenever any are configured. Server-to-server calls carry no origin and are never gated. Customer installation is at your own pace — the API is live and ready.

Allowed origins

An origin is a scheme, host, and port — https://example.com, not a full URL with a path. The list on Setup tells Volance which browser origins may request a session manifest, which is how the collector is configured before it runs on one of your pages.

One per line: Up to 32 entries. Each is a complete origin, such as https://example.com or https://app.example.com:8443.
HTTPS only: Plain HTTP is accepted on localhost, 127.0.0.1, and [::1], so local development needs no certificate.
No path, query, or credentials: https://example.com/checkout is rejected: an origin identifies a site, not a page. A rejected entry is named in the error.

What it gates. A browser asking GET /api/trace/session sends an Origin header. When your list is not empty and that origin is not on it, the request is refused with 403 and Origin … is not in this workspace's allowed origins.

What it never gates. Server-to-server calls carry no Origin header, so scoring from your backend with sk_ is never origin-checked. The list protects the browser hand-off, not your API.

An empty list is treated as “not configured yet”: a browser manifest request is allowed rather than refused, and nothing else in the product gates on it. It is not a safety default — the public key may live in page code, so the list is what stops a copied key being used to fetch manifests from someone else's site. Set it before you install the collector on a real site.

Origins belong to one project, so a workspace protecting several sites lists each one. A change takes effect on the next manifest request, and the audit trail records it.

Frequently asked

Why is Overview empty? No live traffic has been scored yet. Copy the secret key to your backend and call POST /api/trace/score; the Test tab shows scratchpad results in the meantime.

Why do two similar visits score differently? The score is evidence-weighted, not a fixed lookup. Sparse sessions produce wider estimates, and the Signals table shows exactly which checks moved it.

How do I delete data? Delete individual sessions in Sessions, or delete the whole workspace under Setup → Danger zone. Raw records also expire after 30 days by default.

Who do I contact? Use the contact form in the Usage tab; we reply by email.

Read the API reference for request and response details, or the integration overview for the architecture.

Everything in the portal, explained.