Start here

Build with Bastion.

Developer guides for connecting your application to fraud scoring, bot protection, signed webhooks, and workspace SSO.

On this page

One collection layer. Your server in control.

Collect device and behavior telemetry in your frontend. Send the complete verification request to your backend. Your backend supplies trusted account and order details, calls Bastion with the site secret, and enforces the returned action before completing a sensitive operation.

Step	Runs in	Responsibility
01 · Collect	Customer browser	Public site key; fingerprint, behavior, environment, and token.
02 · Verify	Your application server	Authenticate the customer, load authoritative context, and score with the secret key.
03 · Enforce	Your application server	Allow, hold for review, challenge, or block.
04 · Reconcile	Your webhook receiver	Verify signatures and durably process decision.created deliveries.

Quickstart

Connect a browser and an authenticated backend.

API reference

Requests, decisions, authentication, and batches.

Webhooks

A signed receiver with durable deduplication.

SAML single sign-on

Connect your identity provider to your workspace.

Endpoints and credentials

bash

# Data plane: browser collection and server verification
BASTION_ENDPOINT=https://api.bastionsecurity.io/api/antibot

# Server environment only. Obtain keys in Workspace → Integration.
BASTION_SITE_KEY=YOUR_PUBLIC_SITE_KEY
BASTION_SECRET_KEY=YOUR_SERVER_SECRET

# Webhook receiver only. Obtain in Workspace → Webhooks.
BASTION_WEBHOOK_SECRET=YOUR_WEBHOOK_SIGNING_SECRET

Choose your implementation

Browser SDK

JavaScript, hosted script, SPA lifecycle, and telemetry.

Server SDKs

Node.js, Python, Go, Ruby, and PHP.

Decision handling

Action policies, review, monitoring, and evidence.

Production checklist

Rollout, CSP, key rotation, and integration testing.