# Capabilities

Three tiers. Keyless is free and complete in the browser; a key unlocks everything that needs a server to trust you.

| Hook / function | Keyless | Public key + verified domain | Secret key (server) |
|---|---|---|---|
| `init`, `ready()`, `verdict()`, `on('verdict'\|'final')`, `identify()`, `reset()`, queue `push` | ✓ | ✓ | – |
| Integrations tagging (GA4, GTM, Meta, TikTok, Google Ads, Shopify, Mixpanel, Segment, PostHog, Amplitude, Klaviyo, Mailchimp, HubSpot, Intercom, Clarity, Hotjar) and bot ad-conversion blocking | ✓ | ✓ | – |
| Edge hint (`Server-Timing`) | ✓ | ✓ | – |
| Beacon (`flush`, pagehide) | ✓ anonymous, by hostname, every session | ✓ | – |
| Live presence (HQ Live now) | ✗ | ✓ | – |
| `check(action)`, `getToken()`, `stripeToken()`, `protect(form)` (signed tokens) | ✗ rejects `key_required` | ✓ bound to the site; origin must be verified | – |
| The Handler (Jev) on ambiguous sessions | ✗ | ✓ (plan-gated) | – |
| `verifyToken` (`@doubleagent-so/node`, offline JWKS) | ✓ | ✓ | ✓ |
| `getSession`, `/v1/sessions`, `/v1/stats`, `/v1/live` | ✗ | In HQ, after login | ✓ `Bearer sk_…` |
| Debrief webhooks, server relabel (GA4, Klaviyo, Mixpanel, Shopify, Stripe) | ✗ | Configure in HQ | ✓ |
| `/v1/install-check`, JWKS, signatures | ✓ | ✓ | ✓ |

- **Nobody sees keyless data** until someone verifies the domain. Then it's [claimed](/docs/claim), history included.
- **Keyless error:** `DoubleAgentError('key_required')` from any token method, with a link to this page.
- **Upgrade in place:** add `data-key="pk_…"` to the same script tag. Nothing else changes.