What is the server check (Layer 2) and how do I add it?

Your server asks Kinga before a sensitive action and follows the answer. Ready-made helpers exist for Node.js (Express), PHP (including Laravel and WordPress plugins) and Python (Django, Flask); any other language can call the API directly.

Steps for your developer:

• Create a secret key in Connect → API keys (it starts with sk_, keep it on the server only).
• Install the helper from the Install page and call check() before login, sign-up and payment.
• Report what happened afterwards (login_failed, login_success ...) so password guessing is spotted.

In PHP, $kinga->guard(); at the top of every page also keeps blocked visitors out on the server.