Node.js SDK

npm install https://inlineshield.io/downloads/sdk/inlineshield-node-1.0.0.tgz

import { Client } from '@inlineshield/node';

// Server-side only: your secret key (bs_live_… or bs_test_…) from the console, Settings › Keys.
const shield = new Client(process.env.INLINESHIELD_API_KEY, {
  timeoutMs: 3000, // per request (the default)
  failOpen: true,  // the default: an outage gives an "unavailable" result with action "allow"
});

import { Client } from '@inlineshield/node';

const shield = new Client(process.env.INLINESHIELD_API_KEY);

// In your sign-up handler (Express): the browser script put the token in the form.
async function screenSignup(req) {
  const email = req.body.email;
  const checked = await shield.siteverify(req.body.betshield_token, email);
  if (checked.success || checked.unavailable) return checked;
  if (checked.error === 'NO_TOKEN') {
    // The script was blocked, timed out or is missing: screen on the server instead.
    return shield.verify({ email, ip: req.ip, userAgent: req.get('user-agent') });
  }
  return { action: 'block', error: checked.error }; // INVALID_TOKEN, EXPIRED_TOKEN, TOKEN_ALREADY_USED, EMAIL_MISMATCH
}

const result = await screenSignup(req);
switch (result.action) {
  case 'allow': /* create the account */ break;
  case 'hold': /* create it pending and keep result.reviewId (live holds) */ break;
  case 'block': /* reject the sign-up */ break;
}

import { Client } from '@inlineshield/node';

const shield = new Client(process.env.INLINESHIELD_API_KEY);

const result = await shield.verify({
  email: req.body.email,
  ip: req.ip,                       // the player's IP, not your server's
  userAgent: req.get('user-agent'), // the player's browser
  username: req.body.username,      // optional
});
// result.action: "allow", "hold" or "block"; result.riskScore 0-100; result.reasons
if (result.unavailable) {
  // InlineShield could not answer: action is "allow" (fail-open); result.error says why.
}

import { Client } from '@inlineshield/node';

const shield = new Client(process.env.INLINESHIELD_API_KEY);

// By the requestId InlineShield returned (accepted for screenings up to 180 days old):
const sent = await shield.feedback(requestId, 'fraud', { category: 'bonus_abuse', note: 'Chargeback on first deposit' });
// Or by the browser token, for about a day after the screening:
await shield.feedback({ token }, 'legit', { category: 'good_customer' });
// sent.changed is false when the same feedback was already recorded.

import { Client } from '@inlineshield/node';

const shield = new Client(process.env.INLINESHIELD_API_KEY);

// The reviewId of a held sign-up. Webhooks tell you first; this is the fallback.
const review = await shield.getReview(reviewId);
if (review.status === 'approved') {
  // activate the account
} else if (review.status === 'rejected') {
  // delete or disable it (review.decisionReason: "operator" or "expired")
}

import { verifyWebhook, WebhookVerificationError } from '@inlineshield/node';

// Express: app.post('/inlineshield/webhook', express.raw({ type: '*/*' }), handleWebhook);
// express.raw keeps the exact bytes InlineShield signed: do not use express.json() on this route.
function handleWebhook(req, res) {
  let event;
  try {
    event = verifyWebhook(req.get('X-InlineShield-Signature'), req.body, process.env.INLINESHIELD_WEBHOOK_SECRET);
  } catch (err) {
    if (err instanceof WebhookVerificationError) return res.status(400).send(err.code);
    throw err;
  }
  if (event.event === 'signup.approved') {
    // activate the account that has reviewId event.data.reviewId
  } else if (event.event === 'signup.rejected') {
    // delete or disable it (event.data.decisionReason)
  }
  // Deliveries can repeat: make this idempotent (key on event.id).
  res.sendStatus(200);
}

import { Client, AuthError, ApiError, UnavailableError, RateLimitError, QuotaError } from '@inlineshield/node';

const shield = new Client(process.env.INLINESHIELD_API_KEY);

let result;
try {
  result = await shield.verify({ email: req.body.email, ip: req.ip, userAgent: req.get('user-agent') });
  if (result.unavailable) {
    // Fail-open: result.error is TIMEOUT, UNAVAILABLE, RATE_LIMIT_EXCEEDED, TEST_LIMIT or QUOTA_EXCEEDED.
  }
} catch (err) {
  if (err instanceof AuthError) {
    // INVALID_API_KEY, EXPIRED_API_KEY, TENANT_SUSPENDED…: fix the configuration (thrown even with failOpen).
  } else if (err instanceof ApiError) {
    // The request was refused: err.code (e.g. INVALID_IP) and err.status.
  }
  throw err;
}

// Fail-closed instead: with failOpen: false an outage throws.
const strict = new Client(process.env.INLINESHIELD_API_KEY, { failOpen: false });
try {
  await strict.verify({ email: req.body.email, ip: req.ip, userAgent: req.get('user-agent') });
} catch (err) {
  if (!(err instanceof UnavailableError || err instanceof RateLimitError || err instanceof QuotaError)) throw err;
  // InlineShield is unavailable: reject the sign-up, or ask the player to try again (err.retryAfter on a rate limit).
}