Build secure integration
with zero logic leak.

Node.js - Start verification

// Node.js — Start visual verification
const crypto = require("crypto");

async function startVisualAuth(userId) {
  const state = crypto.randomUUID();

  const res = await fetch(
    `${process.env.FRAUDSHIELD_BASE_URL}/api/product/v1/init-auth?mode=live`,
    {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "x-api-key": process.env.FRAUDSHIELD_API_KEY,
      },
      body: JSON.stringify({
        partnerId: process.env.FRAUDSHIELD_PARTNER_ID,
        userId,
        callbackUrl: `${process.env.APP_BASE_URL}/auth/visual/callback`,
        state,
      }),
    }
  );

  if (!res.ok) throw new Error("Failed to start visual auth");
  const data = await res.json();

  // Store state in session for callback validation
  req.session.pendingVisual = { userId, state };

  return data; // { sessionToken, verifyPath, expiresAt }
}

Node.js - Validate result

// Node.js — Validate verification result
async function consumeVisualResult(signature) {
  const res = await fetch(
    `${process.env.FRAUDSHIELD_BASE_URL}/api/product/v1/partner/consume-result?mode=live`,
    {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "x-api-key": process.env.FRAUDSHIELD_API_KEY,
      },
      body: JSON.stringify({ signature }),
    }
  );

  if (!res.ok) throw new Error("Signature validation failed");
  return await res.json();
  // { result: "PASS", userId, partnerId, state, consumedAt }
}

Node.js - Callback handler

// Node.js (Express) — Callback handler
app.get("/auth/visual/callback", async (req, res) => {
  const { result, signature, state } = req.query;
  const pending = req.session.pendingVisual;

  if (!pending || state !== pending.state) {
    req.session.pendingVisual = null;
    return res.status(401).send("Invalid state");
  }

  if (result !== "PASS" || !signature) {
    req.session.pendingVisual = null;
    return res.status(401).send("Visual verification failed");
  }

  const consumed = await consumeVisualResult(signature);
  req.session.user = consumed.userId;
  req.session.pendingVisual = null;

  return res.redirect("/dashboard");
});