Portcullis

What it is

Portcullis is Zipper’s own human check. Visitors see a short widget. Zipper looks at the browser, does a small puzzle, and hands your page a one-time token. You send that token to Siteverify. It is not a third-party CAPTCHA network.

Cloudflare analogue: Cloudflare Turnstile. SLA 99.95% · p99 180ms. Operators tune difficulty. Admins create widgets.

• ▸Widget on your page
• ▸Browser signals plus a small puzzle
• ▸One-time tokens
• ▸Siteverify API

How it works

Create a widget. You receive a public site key and a secret shown once.

Embed api.js and a div with data-sitekey. The widget collects signals, solves a short proof-of-work, and mints a one-time token.

POST that token to Siteverify with the secret. Never trust the browser alone.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Portcullis → Create widget.

Copy the secret. Embed the snippet from Docs → Portcullis.

API

Control-plane: POST /api/portcullis/v1/siteverify. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

<script src="https://tinyzipper.com/portcullis/v1/api.js" async defer></script>
<form method="POST" action="/login">
  <div class="tz-portcullis" data-sitekey="0xSITE_KEY" data-theme="dark"></div>
  <button type="submit">Enter</button>
</form>

curl -sS -X POST https://tinyzipper.com/api/portcullis/v1/siteverify \
  -H "Content-Type: application/json" \
  -d '{"secret":"0xSECRET","response":"<token>"}'

const res = await fetch("https://tinyzipper.com/api/portcullis/v1/siteverify", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ secret: process.env.PORTCULLIS_SECRET, response: token }),
});
const json = await res.json();
if (!json.success) throw new Error("Portcullis failed");

const res = await fetch("https://tinyzipper.com/api/v1/whoami", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Tokens are single-use. A replay returns timeout-or-duplicate.

Demo key 0xDEMO with secret demo works on this origin for local tests.

• ▸SOC 2
• ▸GDPR
• ▸CCPA

Runbook

Fail closed if a token cannot be issued. Rotate site secrets from the Portcullis page.

Live demo

Runs against this origin with the platform demo site key.