Get started

script-src 'self' https://edge.trustsig.eu;
frame-src https://edge.trustsig.eu;
worker-src https://edge.trustsig.eu blob:;
connect-src 'self' https://edge.trustsig.eu

// Fires once the first scan resolves, with a token or an error.
window.addEventListener('trustsig:ready', (e) => {
  const { token, error } = e.detail;

  // Release the button either way. Your server enforces the verdict.
  document.getElementById('submit-btn').disabled = false;

  if (error) console.warn('TrustSig scan failed:', error);
});

async function submitForm() {
  // Waits for the running scan, or returns the cached token immediately.
  const { token } = await window.TrustSig.getResponse();

  await fetch('/api/login', {
    method: 'POST',
    headers: { 'X-TrustSig-Response': token },
    body: JSON.stringify({ email: '[email protected]' }),
  });
}

async function submitForm() {
  const result = await window.TrustSig.scan({
    key: 'pk_live_3426256ed11ff6e0f55af31c8328afe5',
  });
  const token = result?.token ?? null;

  await fetch('/api/login', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-TrustSig-Response': token,
    },
    body: JSON.stringify({ email: '[email protected]' }),
  });
}

script-src 'self' https://edge.trustsig.eu;
frame-src https://edge.trustsig.eu;
worker-src https://edge.trustsig.eu blob:;
connect-src 'self' https://edge.trustsig.eu

import { TrustSigClient } from '@trustsig/client';

const client = new TrustSigClient({ siteKey: 'pk_live_YOUR_SITE_KEY' });

// Resolves to { request_id, token }, or null when no scan produced a token.
const response = await client.getResponse();

await fetch('/api/checkout', {
  method: 'POST',
  headers: { 'X-TrustSig-Response': response?.token ?? '' },
  body: JSON.stringify(order),
});

const client = new TrustSigClient({
  siteKey: 'pk_live_YOUR_SITE_KEY',
  autoScan: false,
  // Without this the token ages out and verification starts failing closed.
  keepFresh: true,
});

const response = await client.scan();

const client = new TrustSigClient({
  siteKey: 'pk_live_YOUR_SITE_KEY',
  requireConsent: true,
});

onCookieBannerAccept(() => client.setConsent(true));
onCookieBannerReject(() => client.setConsent(false));

// Waits for the next scan, and starts one when none is in flight.
const deviceId = await client.getDeviceId();          // "3f2a9c14b7e05d68"

// Bound wait. Resolves null when the scan has not returned in time.
const quick = await client.getDeviceId({ timeout: 2000 });

// Synchronous. Null before the first scan resolves, and after a failed scan.
const token = client.getCachedToken();

if (token) headers['X-TrustSig-Response'] = token;

import { normalizeScanResult } from '@trustsig/client';

window.addEventListener('trustsig:ready', (e) => {
  // Null for a missing or ERROR:-prefixed token.
  const response = normalizeScanResult(e.detail);

  if (response) stampPendingRequests(response.token);
});

script-src 'self' https://edge.trustsig.eu;
frame-src https://edge.trustsig.eu;
worker-src https://edge.trustsig.eu blob:;
connect-src 'self' https://edge.trustsig.eu

"use client";
import { TrustSigProvider } from '@trustsig/react';

export default function RootLayout({ children }) {
  return (
    <TrustSigProvider siteKey="pk_live_..." autoScan>
      {children}
    </TrustSigProvider>
  );
}

"use client";
import { useTrustSig } from '@trustsig/react';

export function LoginForm() {
  const { getResponse } = useTrustSig();

  const handleSubmit = async (e) => {
    e.preventDefault();

    // Resolves as soon as the scan that started on mount finishes.
    const { token } = await getResponse();

    await fetch('/api/login', {
      method: 'POST',
      headers: { 'X-TrustSig-Response': token },
    });
  };
}

// deviceId: true waits for a scan, so the exchange can answer with the id.
const handle = await client.flushMouse({ behavior: true, deviceId: true });

await fetch('/api/checkout', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ ...order, behavior_token: handle }),
});

let behaviorToken = '';

// Every scheduled flush hands you a handle, so one is ready before the submit.
const stop = client.onBehaviorReady(({ token }) => {
  behaviorToken = token;
});

import { TrustSig } from '@trustsig/server';

const ts = new TrustSig({ secretKey: process.env.TRUSTSIG_SECRET_KEY });
const behavior = await ts.getBehavior(handle);

// Check error first: it is not the same answer as "no evidence".
if (behavior.error) return proceedWithoutPointerEvidence();

if (behavior.behavior.state === 'rich' && behavior.behavior.human_score < 30) {
  return reject('automated pointer path');
}

behavior.device.id;   // the device id, when the flush asked for it

app.post('/login', async (req, res) => {
  const token =
    req.body['trustsig-response'] ||
    req.headers['x-trustsig-response'];

  const result = await fetch('https://edge.trustsig.eu/verify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      secret: process.env.TRUSTSIG_SECRET_KEY,
      token,
    }),
  });

  const v = await result.json();

  // is_bot is true once the session crossed the block threshold.
  if (v.is_bot) {
    log.warn(
      {
        device_id: v.identity.device_id,
        risk_score: v.risk.score,
        reason_codes: v.risk.reason_codes,
      },
      'login blocked',
    );
    return res.status(403).json({ error: 'Access denied.' });
  }

  // A clean session on a hosting network still deserves a second factor.
  if (v.network.datacenter) {
    return stepUp(v.identity.device_id);
  }

  // proceed with login
});

{
  "action": "ALLOW",
  "is_bot": false,
  "score": 0,
  "issued_at": 1785942067,
  "request_id": "d1e23499e6c16c6",
  "schema_version": 5,
  "risk": {
    "score": 17,
    "level": "low",
    "reason_codes": [
      "TAMPERED_ENVIRONMENT",
      "ANTI_DETECT_BROWSER",
      "PRIVACY_CANVAS_RANDOMIZATION"
    ],
    "revision": 0,
    "revised": false
  },
  "identity": {
    "device_id": "af6aaf8b92b2233a",
    "confidence": 100,
    "degraded": false,
    "first_seen": 1785855667,
    "last_seen": 1785942067,
    "sightings": 12,
    "returning": true
  },
  "device": {
    "class": "desktop",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
    "browser_family": "chrome",
    "os_family": "macintosh",
    "platform": "MacIntel",
    "languages": ["en-US"],
    "timezone": "Europe/Tallinn",
    "font_count": 17,
    "incognito": false,
    "screen": {
      "resolution": "1440x900",
      "pixel_ratio": 2,
      "touch_points": 0
    },
    "hardware": {
      "cpu_cores": 8,
      "memory_gb": 8,
      "gpu_vendor": "Google Inc. (Apple)",
      "gpu_renderer": "ANGLE (Apple, ANGLE Metal Renderer: Apple M3, Unspecified Version)"
    }
  },
  "network": {
    "country": "EE",
    "region": "Harjumaa",
    "city": "Tallinn",
    "connection_type": "residential",
    "vpn": false,
    "tor": false,
    "datacenter": false,
    "mobile": false,
    "tls_version": "TLSv1.3",
    "http_protocol": "HTTP/2"
  },
  "integrity": {
    "tampered": true,
    "automation": false,
    "anti_detect_browser": true,
    "privacy_tooling": true,
    "virtual_machine": false,
    "runtime_patched": false,
    "platform_mismatch": false,
    "rendering_anomaly": false,
    "spoofing": {
      "detected": false
    }
  },
  "behavior": {
    "mouse": {
      "verdict": "human",
      "analyzed": true,
      "human_score": 91,
      "automated": false,
      "sufficient_data": true,
      "samples": 1420,
      "batches": 6,
      "coverage": "rich"
    }
  },
  "velocity": {
    "device": {
      "first_seen": 1785855667,
      "last_seen": 1785942067,
      "total": 12,
      "last_5m": 1,
      "last_1h": 3,
      "last_24h": 12,
      "last_7d": 12,
      "last_30d": 12
    },
    "peak_requests_1m": 1
  },
  "flags": {
    "bot": false,
    "automation": false,
    "anti_detect_browser": true,
    "tampered_environment": true,
    "privacy_tooling": true,
    "virtual_machine": false,
    "runtime_patched": false,
    "platform_mismatch": false,
    "rendering_anomaly": false,
    "spoofed_device": false,
    "incognito": false,
    "vpn": false,
    "tor": false,
    "datacenter": false,
    "mobile_network": false,
    "synthetic_behavior": false,
    "automated_mouse": false,
    "challenge_failed": false,
    "high_velocity": false,
    "bad_reputation": false,
    "outdated_client": false,
    "token_problem": false,
    "new_device": false
  }
}

{
  "token": "<scan token>",
  "include": ["device.media", "network"]
}

{
  "device": {
    "class": "desktop",
    "media": {
      "codecs": { "h264": 2, "hevc": 0, "aac": 2, "ac3": 0, "vp9": 2 },
      "hardware_video_decode": true,
      "video_inputs": 1,
      "audio_inputs": 2,
      "audio_outputs": 3,
      "drm": [
        {
          "key_system": "com.widevine.alpha",
          "persistent_state": "required",
          "distinctive_identifier": "not-allowed",
          "session_types": ["temporary"],
          "video_robustness": ["HW_SECURE_ALL", "SW_SECURE_DECODE"],
          "audio_robustness": ["SW_SECURE_CRYPTO"]
        }
      ]
    },
    "...": "..."
  },
  "network": {
    "ip": "203.0.113.9",
    "ip_version": 4,
    "asn": 24940,
    "asn_organization": "Hetzner Online GmbH",
    "country": "DE",
    "region_code": "HE",
    "postal_code": "60313",
    "continent": "EU",
    "timezone": "Europe/Berlin",
    "latitude": 50.1109,
    "longitude": 8.6821,
    "connection_type": "datacenter",
    "tls_cipher": "AEAD-AES128-GCM-SHA256",
    "edge_location": "FRA",
    "...": "..."
  }
}

import { TrustSig } from '@trustsig/server';

const ts = new TrustSig({ secretKey: process.env.TRUSTSIG_SECRET_KEY });
const token = request.headers.get('X-TrustSig-Response');

const result = await ts.verifyRemote(token);

// is_bot is true once the session crossed the block threshold.
if (result.is_bot) throw new Error('Access denied');

import { TrustSig, verdictSummary, hasFlag, mouseVerdict, deviceSightings } from '@trustsig/server';

const result = await ts.verifyRemote(token);

// is_bot is true once the session crossed the block threshold.
if (result.is_bot) {
  log.warn(verdictSummary(result));
  return res.status(403).json({ error: 'Access denied.' });
}

const deviceId = result.identity?.device_id;

if (hasFlag(result, 'automation')) return deny();
if (hasFlag(result, 'tampered_environment')) return stepUp(deviceId);
if (hasFlag(result, 'datacenter') && !isKnownCrawler(result)) return stepUp(deviceId);

// 'inconclusive' means there was not enough movement to judge, so it is not a pass.
if (mouseVerdict(result) === 'automated') return requireSecondFactor(deviceId);
if ((deviceSightings(result, 'last_1h') ?? 0) > 20) return rateLimit(deviceId);
if (result.risk.score >= 60) return requireSecondFactor(deviceId);

return completeLogin({
  device_id: deviceId,
  device_class: result.device?.class,
  browser: result.device?.browser_family,
  returning: result.identity?.returning,
});

action=ALLOW risk=17/low score=0
req=d1e23499e6c16c6 device=af6aaf8b92b2233a country=EE
flags=anti_detect_browser,privacy_tooling,tampered_environment
codes=TAMPERED_ENVIRONMENT,ANTI_DETECT_BROWSER,PRIVACY_CANVAS_RANDOMIZATION

import { isStableDeviceId, deviceSummary, tokenAgeSeconds } from '@trustsig/server';

const key = isStableDeviceId(result) ? result.identity.device_id : `ip:${clientIp}`;
await rateLimit(key);

await auditLog.write({
  device_id: result.identity?.device_id,
  first_seen: result.identity?.first_seen,
  sightings: result.identity?.sightings,
  device: deviceSummary(result),
  token_age_s: tokenAgeSeconds(result),
});

import { explainVerdict, hasReasonGroup, reasonCodesByGroup } from '@trustsig/server';

for (const r of explainVerdict(result)) {
  console.log(r.code, r.group, r.description, r.adverse);
}

if (hasReasonGroup(result, 'velocity')) return rateLimit(result.identity.device_id);
if (hasReasonGroup(result, 'automation')) return deny();

const byGroup = reasonCodesByGroup(result);

import { ReasonCodeCatalog } from '@trustsig/server';

const catalog = new ReasonCodeCatalog();
await catalog.refresh();

catalog.describe('ANTI_DETECT_BROWSER');
catalog.group('ANTI_DETECT_BROWSER');
catalog.all();

const ts = new TrustSig({
  secretKey: process.env.TRUSTSIG_SECRET_KEY,
  timeoutMs: 5000,
  // The default include for every call. A per-call argument wins.
  include: ['network'],
});

import { verifyWebhookSignature } from '@trustsig/server';

// Verify the raw body. A re-serialised body will not match.
const raw = await readRawBody(req);
const signature = req.headers['x-trustsig-signature'];

if (!verifyWebhookSignature(process.env.TRUSTSIG_WEBHOOK_SECRET, signature, raw)) {
  return res.status(400).end();
}

const event = JSON.parse(raw);