# AffixIO Live Desk

> Live browser instrument that proves against api.affix-io.com. The API key stays server-side.

Canonical: https://www.affix-io.com/live-desk/
Reviewed: 2026-11-08
Machine brief: https://www.affix-io.com/live-desk/llms.txt

## What it does

- Browser calls `/live-desk/api.php` only.
- PHP reads a private host key and calls:
  - `GET https://api.affix-io.com/v1/auth/check`
  - `POST https://api.affix-io.com/v1/circuits/yesno/prove`
- Returns decision, proof_id, proof_digest, ML-DSA-65 attestation fields and Merkle inclusion.
- Approve and deny scenarios use synthetic yesno condition fields. No personal records are sent.

## Security

- API key never appears in HTML or JavaScript.
- Origin checks, rate limits and a demo header gate prove calls.
- Public responses sanitise signature previews; full proof bodies are not echoed to the page.

## Open source UI extras

- Chart.js (MIT) for latency series
- qrcodejs (MIT) for proof-id QR carriers

## Related

- https://www.affix-io.com/sdk/
- https://www.affix-io.com/docs/
- https://www.affix-io.com/black-sky/
- https://www.affix-io.com/how-it-works/