Anti-cheat for online assessments
What it is
Procteye watches an assessment for signs of cheating — the candidate looking off-screen, a second face appearing, a phone in frame, a voice in the background, a switched tab, a virtual machine — and turns those raw signals into a single risk score and a verdict your platform can act on. Detection runs on the candidate's own device; your backend and ours only ever see classified events, never a raw video feed.
You integrate at two seams: a server-to-server API (create sessions, receive webhooks, pull reports) authenticated with a secret key, and a browser/mobile SDK that runs the actual monitoring using a short-lived, scoped client secret. The server always owns the verdict — the client can never mark itself clean. There is no ML to train and no camera pipeline to build: start by choosing the assurance tier and evidence policy that match the decision you need to make.
Three assurance tiers
Pick the level of assurance the exam warrants. Higher tiers layer more coverage on top of the one below — you request a tier per session, and the report tells you which tier was actually achieved.
Runs entirely in the candidate's browser tab. Tab-focus, copy/paste, fullscreen-exit and single-face checks via the webcam. Zero install — embed and go.
Adds a second camera: the candidate's phone becomes a side-angle observer, catching phones-on-desk, second people and looking-down that a laptop cam misses.
Adds the Procteye lockdown client — kiosk mode, keyboard hook, VM detection and screen-capture heuristics. The hardened tier for high-stakes, credentialing-grade exams.
On-device first
Every gaze, head-pose, object and audio classifier runs locally in the browser (via MediaPipe) or on the phone — the video never leaves the device unless you explicitly opt into evidence capture. When you do, you choose the minimum: none, thumbnails, or short clips around flagged moments. Procteye is designed with GDPR, FERPA and BIPA in mind.
How it fits together
The moving parts, end to end:
- Your backend calls
POST /external/v1/sessionswith your secret key and gets a session id + scoped client secret. - The SDK (
@procteye/proctor-js) boots in the candidate's browser, runs preflight, collects consent, then monitors on-device and streams classified violations. - Procteye's engine scores those violations server-side against a per-session baseline and emits webhooks as thresholds are crossed.
- You receive a final verdict (
clean,flagged,removed, orinconclusive) plus an evidence-backed report.
Ready to see a violation fire? The quickstart gets you there in under five minutes.