PHP SDK

composer config repositories.inlineshield composer https://inlineshield.io/composer
composer require inlineshield/inlineshield-php:^1.0

# Without Composer: unzip https://inlineshield.io/downloads/sdk/inlineshield-php-1.0.0.zip
# and require 'inlineshield-php/autoload.php';

{
  "repositories": [
    { "type": "composer", "url": "https://inlineshield.io/composer" }
  ],
  "require": {
    "inlineshield/inlineshield-php": "^1.0"
  }
}

<?php
require __DIR__ . '/vendor/autoload.php';

use InlineShield\Client;

// Server-side only: your secret key (bs_live_… or bs_test_…) from the console, Settings › Keys.
$shield = new Client(getenv('INLINESHIELD_API_KEY'), [
    'timeoutMs' => 3000, // per request (the default)
    'failOpen' => true,  // the default: an outage gives an "unavailable" result with action "allow"
]);

<?php
require __DIR__ . '/vendor/autoload.php';

use InlineShield\Client;

$shield = new Client(getenv('INLINESHIELD_API_KEY'));

// In your sign-up handler: the browser script put the token in the form.
function screen_signup(Client $shield, string $email): array
{
    $checked = $shield->siteverify($_POST['betshield_token'] ?? null, $email);
    if ($checked['success'] || $checked['unavailable']) {
        return $checked;
    }
    if ($checked['error'] === 'NO_TOKEN') {
        // The script was blocked, timed out or is missing: screen on the server instead
        // (the SDK sends the visitor's IP and User-Agent from $_SERVER).
        return $shield->verify(['email' => $email]);
    }
    return ['action' => 'block', 'error' => $checked['error']]; // INVALID_TOKEN, EXPIRED_TOKEN, ...
}

$result = screen_signup($shield, (string)($_POST['email'] ?? ''));
switch ($result['action']) {
    case 'allow': // create the account
        break;
    case 'hold': // create it pending and keep $result['reviewId'] (live holds)
        break;
    case 'block': // reject the sign-up
        break;
}

<?php
require __DIR__ . '/vendor/autoload.php';

use InlineShield\Client;

$shield = new Client(getenv('INLINESHIELD_API_KEY'));

$result = $shield->verify([
    'email' => (string)($_POST['email'] ?? ''),
    'username' => $_POST['username'] ?? null, // optional
    // 'ip' and 'userAgent' default to the visitor's (REMOTE_ADDR and the User-Agent header);
    // behind a proxy, give the Client 'trustedProxies' or pass 'ip' yourself.
]);
// $result['action']: 'allow', 'hold' or 'block'; $result['riskScore'] 0-100; $result['reasons']
if ($result['unavailable']) {
    // InlineShield could not answer: action is 'allow' (fail-open); $result['error'] says why.
}

<?php
require __DIR__ . '/vendor/autoload.php';

use InlineShield\Client;

$shield = new Client(getenv('INLINESHIELD_API_KEY'));

// By the requestId InlineShield returned (accepted for screenings up to 180 days old):
$sent = $shield->feedback($requestId, 'fraud', ['category' => 'bonus_abuse', 'note' => 'Chargeback on first deposit']);
// Or by the browser token, for about a day after the screening:
$shield->feedback(['token' => $token], 'legit', ['category' => 'good_customer']);
// $sent['changed'] is false when the same feedback was already recorded.

<?php
require __DIR__ . '/vendor/autoload.php';

use InlineShield\Client;

$shield = new Client(getenv('INLINESHIELD_API_KEY'));

// The reviewId of a held sign-up. Webhooks tell you first; this is the fallback.
$review = $shield->getReview($reviewId);
if ($review['status'] === 'approved') {
    // activate the account
} elseif ($review['status'] === 'rejected') {
    // delete or disable it ($review['decisionReason']: 'operator' or 'expired')
}

<?php
require __DIR__ . '/vendor/autoload.php';

use InlineShield\Client;
use InlineShield\InlineShieldWebhookException;

$rawBody = file_get_contents('php://input'); // the raw body, before json_decode
try {
    $event = Client::verifyWebhook(
        $_SERVER['HTTP_X_INLINESHIELD_SIGNATURE'] ?? null,
        $rawBody,
        getenv('INLINESHIELD_WEBHOOK_SECRET')
    );
} catch (InlineShieldWebhookException $e) {
    http_response_code(400); // $e->getErrorCode(): MALFORMED_HEADER, SIGNATURE_MISMATCH, ...
    exit;
}
if ($event['event'] === 'signup.approved') {
    // activate the account that has reviewId $event['data']['reviewId']
} elseif ($event['event'] === 'signup.rejected') {
    // delete or disable it ($event['data']['decisionReason'])
}
// Deliveries can repeat: make this idempotent (key on $event['id']).
http_response_code(200);

<?php
require __DIR__ . '/vendor/autoload.php';

use InlineShield\Client;
use InlineShield\InlineShieldApiException;
use InlineShield\InlineShieldAuthException;
use InlineShield\InlineShieldQuotaException;
use InlineShield\InlineShieldRateLimitException;
use InlineShield\InlineShieldUnavailableException;

$shield = new Client(getenv('INLINESHIELD_API_KEY'));
try {
    $result = $shield->verify(['email' => (string)($_POST['email'] ?? '')]);
    if ($result['unavailable']) {
        // Fail-open: $result['error'] is TIMEOUT, UNAVAILABLE, RATE_LIMIT_EXCEEDED, TEST_LIMIT or QUOTA_EXCEEDED.
    }
} catch (InlineShieldAuthException $e) {
    // INVALID_API_KEY, EXPIRED_API_KEY, TENANT_SUSPENDED...: fix the configuration (thrown even with failOpen).
    throw $e;
} catch (InlineShieldApiException $e) {
    // The request was refused: $e->getErrorCode() (e.g. INVALID_IP) and $e->getStatus().
    throw $e;
}

// Fail-closed instead: with 'failOpen' => false an outage throws.
$strict = new Client(getenv('INLINESHIELD_API_KEY'), ['failOpen' => false]);
try {
    $strict->verify(['email' => (string)($_POST['email'] ?? '')]);
} catch (InlineShieldUnavailableException | InlineShieldRateLimitException | InlineShieldQuotaException $e) {
    // InlineShield is unavailable: reject the sign-up, or ask the player to try again ($e->getRetryAfter() on a rate limit).
}