Credential Stuffing

app.post('/api/login', async (req, res) => {
  const { username, password, shieldlabsRequestId } = req.body;

  // The login is identified with forceCheckAnonymous: there is no User HID to match yet.
  const risk = await waitForScore(shieldlabsRequestId, 1500);
  const deviceId = risk?.device_id;

  // Your own counter, keyed on the durable Device ID (holds through IP rotation).
  // A missing identification or the all-zero Device ID is "no device": key it on the IP.
  const counterKey =
    deviceId && deviceId !== NIL_DEVICE ? `dev:${deviceId}` : `ip:${req.ip}`;
  const attempts = await bumpAttemptCount(counterKey); // 15 min window

  // 1. One device hammering many logins, even across rotated IPs and accounts.
  if (attempts > YOUR_DEVICE_ATTEMPT_LIMIT) {
    return res.status(429).json({ action: 'rate_limited' });
  }

  // 2. No identification (the snippet did not run, or a scripted client skipped it),
  //    the 999 rate-limit marker or an all-zero Device ID: unverified, never clean.
  if (!risk || risk.risk_score > 100 || risk.device_id === NIL_DEVICE) {
    return res.status(200).json({ action: 'require_captcha' });
  }

  // 3. Bots and automation, then the band. A raised score raises the cost of a try.
  const flags = risk.detection_flags ?? {};
  if (flags.browser_automation || flags.javascript_disabled ||
      band(risk.risk_score) === 'Dangerous') {
    return res.status(200).json({ action: 'step_up_2fa' });
  }
  if (band(risk.risk_score) === 'Suspicious') {
    return res.status(200).json({ action: 'require_captcha' });
  }

  return continueLogin(username, password, res);
});

curl "https://account.shieldlabs.ai/api/v1/history/device_id/5eb7fd5c-1c5e-4a9f-9b21-7d2e8c0a1234?limit=100" \
  -H "Authorization: Bearer sec_your_private_api_key"

// Call it inside the login handler, after the guard; a non-null result is the action.
async function fanOutAction(deviceId) {
  const accounts = await accountsBehindDevice(deviceId).catch(() => null);
  if (accounts === null) return 'require_captcha'; // a failed History read is unverified
  if (accounts >= YOUR_ACCOUNT_FANOUT_LIMIT) return 'step_up_2fa';
  return null;
}