OpenTrust

OpenTrust is an open-source, client-side JavaScript SDK that collects browser integrity and behavioral signals to estimate whether a session originates from a human user. The core workflow is a one-shot function call that inspects the browser environment — device characteristics, interaction patterns, and automation indicators — then returns a trust score your backend can consume to gate actions, flag sessions, or feed a downstream risk pipeline.

The defining characteristic is what it deliberately does not collect: no photos, no video, no audio, no biometric media. For teams operating under strict data minimization requirements or whose users are sensitive to camera and microphone prompts, this removes the legal and UX friction that media-based liveness checks introduce. The signal set stays in the browser and the result travels as a lightweight payload.

OpenTrust fits as a composable input rather than a standalone gate. It works well alongside existing authentication flows, bot mitigation middleware, or fraud scoring services — adding a client-side trust signal where those systems have a gap. The gaps in OpenTrust itself are significant at production scale: there is no built-in adaptive model, no server-side signal collection, and no case management or alert tooling. A team running a high-stakes fraud prevention workflow will use this as one feature in a system they own, not as the system itself. Research teams and developers prototyping anti-automation features get the most direct value without needing to build around its limits.

Installation follows standard package manager conventions per the repository documentation. The API surface is intentionally narrow — the vendor describes it as a single callable that returns a structured result — which keeps integration time low and the blast radius of an upgrade small, but also means any logic for acting on the score lives entirely in your application code.