Risk Platform quickstart

​

Before you start

• The Risk Platform turned on for your account. Contact sales if it isn’t.
• Your Site key and a Secret key, from Risk Platform > API Keys in the dashboard. The Site key is safe in browser code and only works from your allowed origins. The Secret key stays on your server. See Keys.
• Node 18 or later for the JavaScript SDK, or Python 3.9 or later for the Python SDK.
• Access to the SDK packages. They are private for now: ask your Abstract contact to give your team access.

npm install @abstract/protection

pip install abstract-protection

​

1. Browser: collect a device token

import { createHostedProtection } from "@abstract/protection/hosted";

// Create one client for the whole app.
const risk = createHostedProtection({ siteKey: "YOUR_SITE_KEY" }); // browser-safe

// On the signup page, when it mounts (React example):
useEffect(() => risk.start("signup"), []);

// In your existing submit handler. Don't await anything before submitting.
await fetch("/signup", risk.withToken("signup", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ email, password }),
}));

• start(flow) loads the collection script in the background and returns a cleanup function. Return it from your effect, or call it when the page unmounts. Start only the flow of the current page, not both flows in a global layout.
• withToken(flow, init) adds the device token to your request in the x-abstract-device-token header. If no token is ready, it returns your request unchanged and the form submits as usual.
• status(flow) returns the local collection state and a stable reason, without exposing the token. Use it while debugging.

from corsheaders.defaults import default_headers

CORS_ALLOWED_ORIGINS = ["https://app.example.com"]
CORS_ALLOW_HEADERS = [*default_headers, "x-abstract-device-token"]

​

2. Backend: send a check

​

Observe first: send after the action

import { Abstract } from "@abstract/protection";

const risk = new Abstract(); // reads ABSTRACT_SECRET_KEY

const user = await createAccount(input);

risk.checkLater("signup", {
  request,
  user: { id: user.id, email: user.email, phone: user.phone },
});

from django.db import transaction
from abstract_protection import Abstract

risk = Abstract()  # reads ABSTRACT_SECRET_KEY

user = create_account(request)

risk.check_later(
    "signup",
    request=request,
    user={"id": user.id, "email": user.email},
    on_commit=transaction.on_commit,
)

• In Python, on_commit=transaction.on_commit sends the check only if the account write commits. A rolled-back signup sends nothing.
• In Node on a serverless platform, pass a waitUntil function to the constructor so the check finishes after the response. With Next.js: new Abstract({ waitUntil: (p) => after(() => p) }), using after from next/server.
• checkLater returns a local status (scheduled or skipped). It confirms the check was handed off, not that it arrived. Use Integration health to confirm delivery.

​

Act on the recommendation

const result = await risk.check("signup", {
  request,
  user: { id: user.id, email: user.email, phone: user.phone },
});

// Fail open: a skipped or failed check counts as allow.
const recommendation = result.status === "completed" ? result.recommendation : null;

if (recommendation === "block") {
  return genericSignupError(); // don't reveal the reason
}
if (recommendation === "review") {
  await sendToReview(user, result.checkId);
}
// allow, or no recommendation: continue as usual

result = risk.check(
    "signup",
    request=request,
    user={"id": user.id, "email": user.email, "phone": user.phone},
)

# Fail open: a skipped or failed check counts as allow.
recommendation = None
if result.status == "completed":
    recommendation = result.response.get("recommendation")

if recommendation == "block":
    return generic_signup_error()  # don't reveal the reason
if recommendation == "review":
    send_to_review(user, result.check_id)
# allow, or no recommendation: continue as usual

​

Fail-open behavior

• status is not completed
• recommendation is null (no policy is configured for the flow yet)
• no device token arrived (the user blocked the script, or collection was late)

​

Login

risk.checkLater("login", { request, user: { id: user.id, email: user.email } });

​

Behind a proxy or load balancer

​

Event IDs

​

3. Test without live data

const sandbox = new Abstract({ secretKey: "sk_test_public_fixtures" });

const result = await sandbox.check("signup", {
  email: "person@example.com",
  eventId: "test:review",
  testFixture: "review",
});

sandbox = Abstract(secret_key="sk_test_public_fixtures")

result = sandbox.check(
    "signup",
    email="person@example.com",
    event_id="test:review",
    test_fixture="review",
)

​

4. Verify the integration

ABSTRACT_SECRET_KEY=sk_... \
npx @abstract/protection doctor --app-url http://localhost:3000 --flow signup --json

​

Before you go live

1. Confirm your exact staging and production origins are allowed for your Site key. Ask support to add any that are missing.
2. Keep the Site key in browser code and the Secret key on your server only. Scan your built assets and source maps for the Secret key.
3. Block the collection script in your browser and confirm signup and login still work.
4. Confirm a failed or rolled-back signup sends no check.
5. Confirm both flows show as verified in Integration.
6. Redact the x-abstract-device-token header from your proxy, analytics and error logs.