Paywall Bypass

<!-- Every metered article page -->
<script type="module">
  const mod = await import(
    'https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY'
  );
  const articleId = document.body.dataset.articleId;
  // One identification per metered view, even when the reader opened another
  // article a minute ago. The callback gives you the requestID; the Device ID
  // and the Risk Score arrive on your backend by webhook.
  mod.forceCheckAnonymous({
    onInitialized: async (result) => {
      const res = await fetch('/api/meter', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
          articleId,
          shieldlabsRequestId: result.status === 'initialized' ? result.requestID : null,
        }),
      });
      const { action } = await res.json();
      if (action === 'paywall') showPaywall(); // your wall
    },
  });
</script>

const FREE_LIMIT = 5; // your free articles per device per period

app.post('/api/meter', async (req, res) => {
  const { articleId, shieldlabsRequestId } = req.body;
  const userHid = req.user?.hashedId; // signed-in readers: the hashed id you pass to the snippet

  // The identification for this view: webhook `data`, or a History row mapped
  // to the same field names, or null when the view carries no request ID.
  const risk = await waitForScore(shieldlabsRequestId, 2000);

  // No identification, another reader's identification or no usable Device ID:
  // meter this view by cookie or IP (next step).
  if (!risk || (userHid && risk.user_hid !== userHid)) {
    return res.json(meterByCookieOrIp(req, articleId));
  }
  // The 999 rate-limit marker. Readers behind one office or campus IP share the
  // per-IP limit, so meter these views by cookie, never by that shared IP.
  if (risk.risk_score > 100) {
    return res.json(meterByCookie(req, articleId));
  }
  if (!risk.device_id || risk.device_id === NIL_DEVICE) {
    return res.json(meterByCookieOrIp(req, articleId));
  }

  // Per-device counter in your own store.
  const views = await incrementDeviceViews(risk.device_id, articleId);
  if (views > FREE_LIMIT) {
    return res.json({ action: 'paywall', reason: 'free_limit_reached', views });
  }
  return res.json({ action: 'allow', reason: 'within_free_limit', views });
});