Before you start
An existing Angular 17+ application and a Public Key. The complete example below uses Angular 22; Angular 17/18 components require standalone: true. Register and verify the website domain in your analytics dashboard. Use credentials from the same domain and environment as the browser check. For a fresh account, start with Quick Start.Get your credentials
Copy the Public Key for your domain from Integration > API keys. A public frontend environment variable may contain this key, but never a Private API Key or webhook signing secret.Install the SDK
yarn add or pnpm add with the same package names if your project uses that package manager. Framework packages remain the application’s responsibility.
Add the integration
The snippets are complete files of a new Angular 22 application (ng new). In an existing
application, add the ShieldLabs lines to your own files; before Angular 20 the root component is
AppComponent in app.component.ts, and in Angular 17 and 18 components also need
standalone: true.
Add the provider next to the providers that are already there:
app.html and app.css are then unused):
/api/signup is your own endpoint. On your server, read the verdict for requestId, for example
with @shieldlabs-ai/node:
identify() resolves and can be refined for up to
about 10 seconds as follow-up checks finish. To keep that wait off the submit, start the
identification when the user begins the action (see
Start the identification early ).
Test on a registered domain. ShieldLabs records identifications only for the domains registered in your account. OnA complete application is inlocalhost(ng serve) the page still receives arequestId, but no identification is recorded and your backend never finds it. To try the whole path, open the page from a registered development domain with its own keys.
examples/standalone, and
Unit tests of your components shows the test providers the
generated app.spec.ts needs after these steps.
Test the complete flow
- Run the application on the registered HTTPS domain with its Public Key.
- Trigger the protected form once and check that a Request ID is sent to your own backend.
- Retrieve that same ID using a server SDK or locate it in the analytics dashboard.
- Test a missing ID and an agent load failure: your backend must treat the action as unverified.
/api/signup routes shown in examples belong to your application; they are not ShieldLabs API endpoints. Connect one of the server quick starts before testing the full action. A successful browser call does not prove scoring is complete.
Troubleshooting
- No History row: confirm the registered domain, credential/environment match and that the browser remained open while collectors posted.
- Missing or pending verdict: scoring is asynchronous. The server helper waits within a bounded budget; handle a missing result and API errors explicitly.
- Authentication error: use the Private API Key for History, not a Public Key, Management Secret Key or MCP OAuth token.
- Invalid webhook signature: verify the original raw bytes with the endpoint’s full signing secret, before trusting parsed JSON.