InlineShield
Start free
Docs menu
Start

InlineShield developer docs

InlineShield screens each sign-up before your server creates the account and answers with a verdict: allow it, hold it for review, or block it. These docs cover the integration, from the first test call to going live.

Last updated

Start here

The quickstart takes you from no account to a screened test sign-up in four steps. Use test mode while you build: test keys never use your monthly quota, and five magic addresses return fixed results.

How screening works explains what comes back: the decision, the action to take, the recommended action, the risk score and the reasons.

Two ways to integrate

  • Browser script and server check. inlineshield.js on your sign-up page checks the browser and adds a single-use token to the form. Your server sends the token to POST /api/v1/siteverify and gets the decision. See Browser script.
  • Server only. Your server sends the email, the player's IP address and User-Agent to POST /api/v1/verify. See Server-only integration.

All pages

Guides

  • Browser script: Add inlineshield.js to your sign-up form with a site key, then redeem its single-use token on your server with /api/v1/siteverify and your secret key.
  • Server-only (/verify): Screen sign-ups from your backend alone: send the player's email, IP address and User-Agent to POST /api/v1/verify and act on the decision it returns.
  • Handling verdicts: Map the action and recommendedAction fields to your sign-up flow: create the account, withhold the bonus, hold it for review, ask for KYC or refuse it.
  • Hold and review: How held sign-ups work: the reviewId, the 72-hour review window, polling GET /api/v1/reviews/{reviewId}, and the signup.approved and signup.rejected webhooks.
  • Outcome feedback: Report what a player turned out to be, fraud or legit, with POST /api/v1/feedback by requestId up to 180 days later, or by the browser token within a day.
  • Webhooks: The webhook events InlineShield sends, their payloads and retries, and how to verify the HMAC-SHA256 signature in PHP, Node.js, Python, Java and C#.
  • Test mode: Build your integration without using quota: test keys, five magic addresses at test.inlineshield.io with fixed results, and what test mode never does.
  • WordPress & WooCommerce: Install the InlineShield plugin on WordPress or WooCommerce, paste your API key and site key, and screen registration, My Account and checkout sign-ups.
  • Going live checklist: What to check before you swap test keys for live keys: allowed domains, the fail-open choice, held sign-ups, webhook signatures, quota and rate-limit headers.

API reference

  • API reference overview: The InlineShield REST API: base URL, authentication with site keys and secret keys, the six endpoints, the error format, and the OpenAPI and Postman files.
  • POST /check: Reference for POST /api/v1/check, the browser call made by inlineshield.js: site key and Origin, request fields, the token response, errors and limits.
  • POST /siteverify: Reference for POST /api/v1/siteverify: redeem the browser token with your secret key and get the decision. Fields, failure reasons, errors and limits.
  • POST /verify: Reference for POST /api/v1/verify, the server-only screening call: request fields, the full response with its analysis objects, errors, quota and limits.
  • POST /feedback: Reference for POST /api/v1/feedback: report a fraud or legit outcome by requestId or token, with a category and a note. Fields, answers, errors and limits.
  • GET /reviews/{reviewId}: Reference for GET /api/v1/reviews/{reviewId}: the status of a held sign-up (pending, approved or rejected), why it was decided, its expiry, errors and limits.
  • GET /health: Reference for GET /api/v1/health: whether the InlineShield API and its database are up. No authentication needed. The 200 and 503 answers and their fields.

SDKs

  • Node.js: The @inlineshield/node package for Node.js 18 or later: install, configure, siteverify, verify, feedback, review status, webhook checks and typed errors.
  • Python: The inlineshield Python package (3.9 or later, standard library only): install, configure, siteverify, verify, feedback, review status, webhooks and errors.
  • PHP: The inlineshield/inlineshield-php Composer package for PHP 7.4 or later: install, configure, siteverify, verify, feedback, review status, webhooks, errors.
  • Java: Screen sign-ups from Java with java.net.http: siteverify with a /verify fallback, review status, webhook signature checks and outcome feedback reporting.
  • C#: Screen sign-ups from C# and ASP.NET Core with HttpClient: siteverify with a /verify fallback, review status, webhook signature checks and outcome feedback.

Reference

  • Errors and HTTP codes: Every error the InlineShield API returns, listed from the OpenAPI file: HTTP status, error code and endpoint, plus the siteverify success: false reasons.
  • Rate limits and quotas: Per-minute rate limits per endpoint, the monthly screening quota, the 402 QUOTA_EXCEEDED answer, test-mode limits, and the X-RateLimit and X-Quota headers.
  • Data and privacy: What InlineShield receives with each sign-up, what it stores, how long raw emails and IP addresses are kept, and what webhooks and test mode contain.
  • Changelog

Base URL and machine-readable files

The API is at https://api.inlineshield.io, for live and test keys alike: the key decides the mode.