> This page is for version 🇺🇸 US.
> For other versions, use one of these documentation indexes:
> - 🇦🇺 AU (default): https://docs.humanapproved.com/au/llms.txt
> - 🇬🇧 UK: https://docs.humanapproved.com/uk/llms.txt
> - 🇺🇸 US: https://docs.humanapproved.com/us/llms.txt

> This is HumanApproved's documentation, as Markdown for AI agents. /llms.txt lists every page; /llms-full.txt has them all. If you're helping someone integrate HumanApproved, start with /guides/ai-coding-agents.

# Changelog

## Embed 1.5.0

The embed now carries the product's name.

### Changed

* **The embed is now `window.HumanApproved`.** `window.OpenApprovals` still works for existing integrations, so no change is needed. New integrations use `HumanApproved`:

  **`checkout-approvals.js`**

  ```js title="checkout-approvals.js"
  window.HumanApproved = window.HumanApproved || { q: [] };
  HumanApproved.q.push(["protect", { /* your options */ }]);
  ```

* **Console messages start with `[humanapproved]`**, instead of `[open-approvals]`.

Copy the new version and its `integrity` hash together from the portal's **Embed** page.

## Embed 1.3.0

Every word of the pause panel now comes from the portal, the customer's decline reason reaches you, monitor-only products never hold a press, and checks are faster from far away.

### New

* **Every word of the panel from the portal.** The pause panel shows all of the wording set on the product's **Agent popup** page, not only the heading, extra instructions, customer note and back button. Change it in the portal and publish: no embed release or code change needed. See [The pause panel](/us/embed/sdk/pause-panel).
* **The customer's decline reason.** When a customer declines with a reason, the panel tells the agent ("Their reason: I've changed my mind."), and `onResult` hears it as `declineReason`, with a stable `code` and the `label` the customer saw.
* **`declineReason` in the status API.** `GET /api/v1/reviews/{reviewId}/status` now returns `declineReason` (`null`, or `{ code, label }`), so your own UI or agent flow can say why too. If you parse the response strictly, allow for new fields.
* **`timeoutMs` for live keys.** Live keys now accept `timeoutMs`, like test keys. For every key it's clamped to 0.5 to 20 seconds. See [protect() options](/us/embed/sdk/options#timeoutms).
* **Monitor-only products never hold a press.** On a product set to monitor only, the press goes straight through and the check runs in the background. `onResult` hears the outcome afterwards with `monitored: true`. See [Monitor only](/us/guides/monitor-only).
* **Timings for the portal's latency charts.** Each check's result now carries how long the press waited, for the new latency charts on the portal's checks page. It's sent in the report the embed already makes and never slows the press.
* **Approval page: a thank-you page** for the customer after they approve.
* **Approval page: every extra listed.** A product that names its extras lists every one on the approval page, ticked or crossed.
* **Approval page: bot check.** You can switch on a bot check for the approval page's actions in a product's approval settings. The customer sees "Checking you're a human…" while it runs.
* **Portal:** approvals, agent detections and checks link to each other, and every portal page, including API keys, shows the selected product only.

### Changed

* **Checks without a CORS preflight.** Once the embed knows the product's settings, it sends the check and its result as simple requests, so the browser no longer makes a preflight round trip before each one. The quote and status calls still carry the review's token in a header and are preflighted, with the preflight cached for up to two hours. Your Content Security Policy needs no change.
* **The approval page** now tells the customer they aren't covered until the purchase is completed.

### Fixed

* The approval page's bot check now waits for its answer instead of letting a slow one through.

## Embed 1.2.0

Make the pause panel look like your own site, from the portal, with no code change.

### New

* **Style the pause panel.** Set its accent colour, corner radius, font (including your page's own font), button shape, heading and text colours, box and label backgrounds, and a logo on the product's **Agent popup** page. Every colour is checked for contrast, and a setting that fails is replaced with the standard look. See [The pause panel](/us/embed/sdk/pause-panel#look).
* **Look and logo from your branding.** The panel can take its look and logo from the product's **Branding** page in the portal.
* **"Protected by HumanApproved"** now appears at the foot of the panel, with your brand name.

### Fixed

* A paused step is now fired again only after the browser has finished handling the original press, so the approved click or submit reliably reaches your own handlers.

## Embed 1.1.0

Hear every outcome in your own code with `onResult`, and a checkout that HumanApproved can't reach now waits at most twice.

### New

* **`onResult` callback.** Pass `onResult` to `protect()` to hear each outcome of a check or review (`continue`, `review`, `approved`, `declined`, `expired` or `fail_open`), with the reason for a fail-open, for your own analytics and monitoring. See [Hearing the outcome](/us/embed/sdk/on-result).
* **A bounded re-check after a fail-open.** After a check fails open, the next press is checked again, waiting at most 1 second. If that also fails open, later presses for the quote go through unchecked until the page reloads, so a customer waits for a failing check at most twice.
* **Checks that got no answer are counted.** When a check gets no response at all (a blocked host, DNS, offline or CORS), the embed reports it with the next check from the same tab, so the portal counts it as failed open.
* **Session replay masking.** The pause panel is masked for Datadog, Hotjar, Microsoft Clarity and FullStory session recordings, so they show a blank box instead of the message and the approval link.

### Changed

* **Live keys always call their region's host**, `https://au.humanapproved.com`, and ignore `timeoutMs`. Before upgrading, make sure your Content Security Policy's `connect-src` allows `https://au.humanapproved.com`: a blocked check fails open.

### Fixed

* The portal's request log masks the customer's mobile number everywhere it appears.