Browser SDK

npm install git+https://github.com/bastionsecurityio/bastionsecurity-sdk-js.git

import Bastion from '@bastionsecurity/sdk';

const bastion = new Bastion({
  siteKey: 'YOUR_PUBLIC_SITE_KEY',
  endpoint: 'https://api.bastionsecurity.io/api/antibot',
});

// Run after the customer has interacted with the page.
const verification = await bastion.buildRequest({
  event_type: 'checkout',
  account_id: 'customer_123',
});

// Your backend authenticates the customer and loads the order.
const response = await fetch('/api/checkout/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(verification),
});
if (!response.ok) throw new Error('Checkout could not be approved');
const result = await response.json();
// Show the next step returned by your backend. Fulfill on the server.

For Next.js, initialize in a client component or effect after mount. Do not instantiate during server rendering. Keep one instance for the application shell and pass the complete buildRequest result to your backend at sensitive operations.

<script src="https://bastionsecurity.io/sdk/bastion.js"></script>
<script>
  const bastion = new BastionSDK.Bastion({
    siteKey: 'YOUR_PUBLIC_SITE_KEY',
    endpoint: 'https://api.bastionsecurity.io/api/antibot',
  });
  // Call bastion.buildRequest(...) from your checkout handler.
</script>

The hosted UMD global is BastionSDK.Bastion. The script URL follows the deployed release; use a pinned npm Git dependency and your own bundle if you need a controlled SDK upgrade schedule. Allow the script host in script-src and the API host in connect-src. For proof-of-work, allow worker-src blob: so the SDK can create its worker; the SDK has a main-thread fallback when a worker cannot start.

await bastion.track('promo_claim', {
  accountId: 'customer_123',
  promoCode: 'WELCOME10',
});

// Before intentionally leaving a page:
await bastion.flush();
bastion.destroy();

track accepts camelCase accountId, paymentHash, promoCode, and amount. The API context uses snake_case. login_succeeded must come from authenticated server validation; browser claims are ignored.

On SPA unmount, call destroy. Call flush first when you need outstanding tracking to complete; destroy aborts it. Browser interaction collection stores timing and motion metrics, not the characters typed into inputs. Missing interaction evidence can affect scoring, so collect during the session rather than creating a fresh SDK just before submission.

Fingerprinting covers canvas, WebGL, audio, screen, browser capabilities, fonts, storage, timing, and automation indicators. Behavior includes bounded mouse, keyboard timing, scroll, and touch samples. Environment includes freshness and consistency evidence. Send the entire buildRequest payload; passing only a token loses the additional behavior and environment evidence.