Your first integration

import Bastion from '@bastionsecurity/sdk';

const bastion = new Bastion({
  siteKey: 'YOUR_PUBLIC_SITE_KEY',
  endpoint: 'https://api.bastionsecurity.io/api/antibot',
});

// Run after the customer has interacted with the page.
const verification = await bastion.buildRequest({
  event_type: 'checkout',
  account_id: 'customer_123',
});

// Your backend authenticates the customer and loads the order.
const response = await fetch('/api/checkout/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(verification),
});
if (!response.ok) throw new Error('Checkout could not be approved');
const result = await response.json();
// Show the next step returned by your backend. Fulfill on the server.

import { ServerBastion } from '@bastionsecurity/sdk';
import type { VerificationRequest } from '@bastionsecurity/sdk';

const bastion = new ServerBastion({
  siteKey: process.env.BASTION_SITE_KEY!,
  secret: process.env.BASTION_SECRET_KEY!,
  endpoint: process.env.BASTION_ENDPOINT || 'https://api.bastionsecurity.io/api/antibot',
});

// Call from your authenticated checkout handler. These values must
// come from your session, database, and payment provider.
export async function verifyCheckout(
  telemetry: VerificationRequest,
  order: { customerId: string; amount: number; paymentId: string },
) {
  const decision = await bastion.verify({
    token: telemetry.token,
    fingerprint: telemetry.fingerprint,
    behavior: telemetry.behavior,
    environment: telemetry.environment,
    idempotency_key: telemetry.idempotency_key,
    context: {
      event_type: 'checkout',
      account_id: order.customerId,
      order_amount: order.amount,
      payment_hash: order.paymentId,
    },
  });

  // Persist request_id with the order for audit and reconciliation.
  // Only 'allow' permits the fulfillment path. The caller must also
  // make payment and order fulfillment independently idempotent.
  return { allowed: decision.action === 'allow', decision };
}