Svelte

npm install @shieldlabs-ai/svelte @shieldlabs-ai/js

PUBLIC_SHIELDLABS_PUBLIC_KEY=0123456789abcdef0123456789abcdef
SHIELDLABS_API_KEY=sec_your_private_key

<!-- src/routes/+layout.svelte -->
<script lang="ts">
  import { PUBLIC_SHIELDLABS_PUBLIC_KEY } from '$env/static/public';
  import { setShieldLabs } from '@shieldlabs-ai/svelte';

  let { children } = $props();

  // Once for the whole app. The agent loads in the browser after hydration.
  setShieldLabs({ publicKey: PUBLIC_SHIELDLABS_PUBLIC_KEY });
</script>

{@render children()}

<!-- src/routes/signup/+page.svelte -->
<script lang="ts">
  import { enhance } from '$app/forms';
  import { useIdentify } from '@shieldlabs-ai/svelte';
  import type { SubmitFunction } from '@sveltejs/kit';

  const { identify, isLoading } = useIdentify();

  const protect: SubmitFunction = async ({ formData }) => {
    const result = await identify(); // null when no identification was possible
    formData.set('requestId', result?.requestId ?? '');
  };
</script>

<form method="POST" use:enhance={protect}>
  <input name="email" type="email" required />
  <button disabled={$isLoading}>Sign up</button>
</form>

// src/routes/signup/+page.server.ts
import { fail } from '@sveltejs/kit';
import { SHIELDLABS_API_KEY } from '$env/static/private';
import { ShieldLabs, ValidationError, evaluateIdentification, type Identification } from '@shieldlabs-ai/node';
import type { Actions } from './$types';

const shieldlabs = new ShieldLabs({ apiKey: SHIELDLABS_API_KEY });
const usedRequestIds = new Set<string>(); // in production, your database

export const actions = {
  default: async ({ request }) => {
    const data = await request.formData();
    const requestId = String(data.get('requestId') ?? '');
    let identification: Identification | null = null;
    if (requestId) {
      try {
        // Waits until the identification is scored (about 1-3 seconds after identify()).
        identification = await shieldlabs.identifications.get(requestId);
      } catch (error) {
        if (!(error instanceof ValidationError)) throw error; // a malformed ID stays unverified
      }
    }
    const verdict = evaluateIdentification(identification, {
      isReplay: (id) => usedRequestIds.has(id), // request IDs that already authorized an action
    });
    if (!verdict.ok) return fail(403, { message: 'We could not verify this signup.' });
    usedRequestIds.add(requestId); // one identification authorizes one signup
    // ...create the account
  },
} satisfies Actions;