Build with AI

Integrate ShieldLabs into <framework> for <protected action>.
Use the current browser and server SDK guides at https://docs.shieldlabs.ai/api/sdks.

Requirements:
- Browser configuration contains only the domain Public Key.
- The browser sends an Identification ID with the protected action, not a score or verdict.
- On the backend, read the result with the domain's Private API Key from an environment variable.
- Authenticate the action and check domain, expected User HID, freshness and Identification ID reuse.
- Use a bounded wait. Missing or unavailable results stay pending or unverified.
- Read current account evidence as well as the score when relevant.
- Make protected benefit creation atomic and idempotent in shared durable storage.

Show complete integration files and tests for success, missing results, stale IDs and reuse.
Use the exact package API from the selected guide; do not invent methods or endpoints.

Build a ShieldLabs webhook receiver for <language/framework>.
Use https://docs.shieldlabs.ai/setup/webhooks and https://docs.shieldlabs.ai/api/webhooks.

Requirements:
- Read original raw request bytes before any JSON parser changes them.
- Verify X-Shield-Signature with HMAC-SHA256 and the endpoint signing secret from an environment variable.
- Compare signatures in constant time and reject an invalid signature.
- Dispatch webhook.ping, identification.scored and hre.multi_account.changed separately.
- Persist accepted events durably and deduplicate by event_id before acknowledging.
- Expect bounded retries, duplicate delivery and possible out-of-order group revisions.
- A group event has no identification_id or risk_score. Apply its revision and lifecycle rules separately.
- Keep slow business processing outside the request handler.

Show the storage interface explicitly; do not substitute a process-local Set for durable idempotency.

Implement a paginated ShieldLabs History read by user_hid.
Follow https://docs.shieldlabs.ai/api/server-api.

Use the Private API Key on the backend only. Validate and encode the path value once.
Use limit 1–100 and continue with page_token from next_page_token.
Handle 400, 401, 403, 404, 429 and server failures explicitly.
A History card reports risk.score only when risk.state is ok. Read the webhook contract when your integration needs weighted signals and detection flags.
The webhook value 999 means Banned IP. It is not a History card score.
Do not call the maximum score of a page the analytics dashboard's current user risk.