Professional identity, as an API.

Let people bring their Moat page into your app. Sign them in, show their card, and hear about every change.

Request partner access Read the quickstart

<script src="https://moat.page/profile/widget.js" defer></script>

<div class="moat-widget"
     data-public-key="PUBLIC_KEY"
     data-level="public"
     data-theme="light"></div>

curl -X POST https://moat.page/profile/api/has_profile \
  -H "X-API-Key: $MOAT_XSITE_API_KEY" \
  -d "[email protected]"

$ch = curl_init('https://moat.page/profile/api/create_profile');
curl_setopt_array($ch, [
  CURLOPT_POST           => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER     => ['X-API-Key: ' . MOAT_XSITE_API_KEY],
  CURLOPT_POSTFIELDS     => http_build_query(['email' => $email]),
]);
$moat = json_decode(curl_exec($ch), true);   // ['public_key' => ...]

const res = await fetch("https://moat.page/profile/api/create_profile", {
  method: "POST",
  headers: { "X-API-Key": process.env.MOAT_XSITE_API_KEY },
  body: new URLSearchParams({ email }),
});
const { public_key, created } = await res.json();

Running in production on

ClubDiumjoqewent

Four building blocks. Use one or all.

Identity API

Check whether a user has a page, get or create one on sign-in, update fields, and query directories of people, companies and services.

API reference

Widgets and editor

Drop-in profile, company and service views, directory lists, and an in-place editor that saves straight to Moat.

Widget docs

Sign-in

Email-code sign-in through Werify, then a server-to-server call that links the person to their Moat page.

Sign-in guide

Webhooks

HMAC-signed events when a page is updated, deleted, suspended or unlinked from your app.

Webhook docs

An integration, start to finish.

The same four steps every partner app follows. The quickstart walks through each one with the exact request and response.

Your user verifies their email with Werify. Your server confirms the result.

Your server is the trust boundary

Link

Call create_profile with their email. Store the public_key it returns.

Get-or-create, safe to repeat

Show and listen

Render their card with the widget, and verify the signed webhooks Moat sends when it changes.

HMAC-SHA256 signatures

Secure by default.

Moat carries people's professional identity, so the defaults are strict and the rules are written down.

Read the partner terms

Keys stay on servers. Browsers only ever use a person's public key.
Contact details need a key. Email and phone are returned only to requests signed with a partner key or the person's private key.
Signed events. JSON webhooks carry an HMAC-SHA256 signature you check with a constant-time compare.
Allowlisted origins. Cross-site requests work only from domains added for your app.
Rate-limited public reads. 60 requests per minute per IP on the public widget endpoint.
Short-lived editor grants. In-place editor saves are signed on your server and expire after four hours.