<script src="https://cdn.botshield.ai/sdk.js"></script>

<botshield-verify
  site-key="pk_live_YOUR_SITE_KEY"
  theme="auto"
  onsuccess="onVerified"
  onfailure="onFailed"
></botshield-verify>

<button id="checkout-btn" disabled>Proceed to Checkout</button>

<script>
  function onVerified({ token }) {
    // Human verified -- enable the button
    document.getElementById('checkout-btn').disabled = false;

    // Send token to your server for validation + signal strength
    fetch('/api/verify', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ botshield_token: token }),
    });
  }

  function onFailed({ reason }) {
    console.error('Verification failed:', reason);
  }
</script>

// Your backend endpoint
app.post('/api/verify', async (req, res) => {
  const { botshield_token } = req.body;

  // Call verify-token to validate signature + extract claims
  const result = await fetch('https://api.botshield.ai/operations/sdk/verify-token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ token: botshield_token }),
  });

  const { data } = await result.json();

  if (!data.valid || !data.claims.verified) {
    return res.status(403).json({ error: 'Verification failed' });
  }

  // The token is anonymous by construction. Its claims are only:
  //   { request_id, verified, organization_id, timestamp, nonce }
  // There is NO email, user id, device data, or auth_mode in the token.
  // Correlate to your own order/session by the request_id you created.
  return res.json({ success: true, request_id: data.claims.request_id });
});

npm install botshield-sdk

import BotShield from 'botshield-sdk';

const client = new BotShield({
  apiKey: 'bs_prod_YOUR_API_KEY',
});

const session = await client.sdk.createSession({
  partner_user_id: 'your_internal_user_id',
});

const sessionToken = session.data.session_token;

const verification = await client.sdk.createVerificationLink(
  {
    scope: 'checkout.complete',
    sdk_type: 'signal',
    return_url: 'https://your-site.com/checkout/callback',
    metadata: { order_id: 'checkout-12345' }, // your own correlation data
  },
  { headers: { Authorization: `Bearer ${sessionToken}` } }
);

// Send to user:
// verification.data.web_url    -- web browser link
// verification.data.deep_link  -- mobile deep link
// verification.data.qr_code_url -- QR code image

{
  "type": "census.human_verified",
  "event_id": "req_xyz789...",
  "request_id": "req_xyz789...",
  "verified_at": "2026-06-16T12:00:00Z",
  "product": "census",
  "metadata": { "order_id": "checkout-12345" }
}

curl -X POST https://api.botshield.ai/operations/verification/status \
  -H "Content-Type: application/json" \
  -d '{"request_id": "req_xyz789..."}'

import { Webhook } from "svix";

const wh = new Webhook(process.env.BOTSHIELD_WEBHOOK_SECRET!); // whsec_...
const evt = wh.verify(rawRequestBody, {       // pass the RAW body, not parsed JSON
  "svix-id": req.header("svix-id")!,
  "svix-timestamp": req.header("svix-timestamp")!,
  "svix-signature": req.header("svix-signature")!,
});

if (evt.type === "census.human_verified" || evt.type === "census.multipass_active") {
  await completeCheckout(evt.request_id, evt.metadata); // correlate by your own request_id
}