Introduction

Every request looks legitimate until it isn't.

A ticket buyer. A customer checking out. A returning user signing in. An account being created.

To your application, they all send valid HTTP requests. The challenge isn't processing requests — it's knowing who's really behind them.

Kyli helps answer that question.

Instead of relying on a single fingerprint collected at the start of a session, Kyli continuously evaluates behavioral, cryptographic, device, and contextual signals throughout the user journey. The result is a decision backed by explainable evidence, giving your application confidence at the exact moment a decision matters.

What it looks like in practice

Imagine you're protecting your checkout flow.

A customer adds products to their cart, enters their shipping address, reviews their order, and clicks Pay. Right before charging the card, your backend asks Kyli for a decision.

const result = await fetch("https://api.kaizocore.com/v1/decide", {
  method: "POST",
  headers: {
    /* signed headers */
  },
  body: JSON.stringify({
    session_token: sessionToken,
    event_type: "checkout",
  }),
}).then((r) => r.json())

A genuine customer browsing naturally, correcting a typo, pausing between fields, and completing checkout normally may receive:

{
  "decision": "ALLOW",
  "score": 8,
  "reasons": []
}

Nothing unusual happened, so there's nothing to explain.

Now imagine a limited-edition product launch.

An automated browser spins up a fresh session, navigates directly to checkout, submits the form in seconds, and reuses infrastructure previously associated with abusive activity.

Kyli sees a very different picture.

{
  "decision": "BLOCK",
  "score": 94,
  "reasons": [
    "bot_user_agent",
    "fp_headless_renderer",
    "bad_actor_registry"
  ]
}

Your application doesn't need to understand every signal Kyli evaluates. It simply acts on the decision.

switch (result.decision) {
  case "ALLOW":
  case "ALLOW_WATCH":
    return proceedToCheckout()

  case "SOFT_CHALLENGE":
    return showCaptcha()

  case "REVIEW":
    return proceedButFlagForReview(result.request_id)

  case "BLOCK":
    return denyAction()
}

Every reason returned by the API is available inside the dashboard's Session Explorer, allowing security teams to understand exactly why a session was allowed, challenged, reviewed, or blocked.

Start with the Quickstart to integrate in minutes, explore How it works to understand the decision pipeline, or jump directly to the API Reference.

Why teams choose Kyli

Most protection systems begin with device and browser identifiers. Those signals are valuable, but they're only part of the picture.

Kyli continuously evaluates a session using multiple independent sources of evidence — including behavioral patterns, cryptographic attestation, environment integrity, device history, and contextual risk — before producing a decision.

Rather than returning an opaque risk score, Kyli explains every decision with evidence your team can inspect and act on.

Built for high-value decisions

Kyli is designed for application endpoints where every decision has a business impact, including:

• Checkout
• Login
• Signup
• Payments
• Password reset
• Gift cards and loyalty programs
• Limited-inventory releases
• Ticketing and event sales

Kyli complements your existing CDN, WAF, and fraud stack by operating at the application layer, where customer actions become business decisions.

Support

This documentation is the primary reference for integrating and operating Kyli.

If you have questions about your implementation, evaluating Kyli for your platform, research collaborations, or contributing to the project, we'd be happy to help.