Shield · Server verification

Server-side verification

The browser SDK provides signals, but browser payloads can be spoofed — use server-side verification for enforcement decisions. Secret API keys never belong in client-side code.

Endpoint

Secret-key authenticated

POST https://shield.findip.net/v1/shield/sessions/verify

// Request
{
  "session_id": "sess_xxx",
  "event": "signup_attempt"
}

// Response
{
  "risk_score": 87,
  "recommendation": "challenge",
  "verified": true
}

Recommended flow

1. BrowserSDK tracks signup_attempt and receives the initial risk signal.

2. Your backendReceives the signup request including the session_id.

3. VerifyBackend calls /v1/shield/sessions/verify with your secret API key.

4. EnforceAllow, challenge, or block based on the verified response.

Integration example

// Frontend: include session ID in the signup request
const { sessionId } = FindIP.getSession();
await fetch('/api/signup', {
  method: 'POST',
  body: JSON.stringify({ email, password, findip_session_id: sessionId }),
});

// Backend: verify before creating the account
const verify = await fetch('https://shield.findip.net/v1/shield/sessions/verify', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.FINDIP_SHIELD_SECRET_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    session_id: req.body.findip_session_id,
    event: 'signup_attempt',
  }),
});