Paywall Enforcement

<!-- Every metered article page -->
<script type="module">
  const mod = await import(
    'https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY'
  );
  // Anonymous read. The callback gives you the IP and the requestID.
  // The DeviceID and Score are not returned here, they arrive by webhook.
  mod.checkAnonymous(undefined, (ip, requestID) => {
    // Hand the requestID to your backend so it can look up the DeviceID
    // for this view and decide whether to meter or wall it.
    document.getElementById('shield-request-id').value = requestID;
  });
</script>

const FREE_LIMIT = 5; // your free articles per device per period

// uuid.Nil: a blocked or JS-disabled view returns the all-zero DeviceID
// and scores 90. You cannot meter an identity that was never built.
const ZERO_DEVICE = '00000000-0000-0000-0000-000000000000';

app.post('/api/meter', async (req, res) => {
  const { articleId, shieldRequestId } = req.body;

  // Pull the ShieldLabs result for this view from the shared cache.
  const shield = await waitForScore(shieldRequestId, 2000);
  const deviceId = shield?.deviceID;

  // No DeviceID, or the all-zero one: fall back to a cookie or IP meter
  // for this view rather than serving it free forever. See the limits below.
  if (!deviceId || deviceId === ZERO_DEVICE) {
    return res.json(meterByCookieOrIp(req, articleId));
  }

  // Per-DeviceID counter in your own store. Clearing cookies or opening
  // incognito does not change the DeviceID, so this count is not resettable
  // that way.
  const views = await incrementDeviceViews(deviceId, articleId);

  if (views > FREE_LIMIT) {
    return res.json({ action: 'paywall', reason: 'free_limit_reached', views });
  }
  return res.json({ action: 'allow', reason: 'within_free_limit', views });
});