Authentication

// Only use Action ID in frontend code
Deflect.configure({
  actionId: "YOUR_ACTION_ID", // Safe to use client-side
});

const token = await Deflect.getToken();

// Use both API Key and Action ID on backend
const response = await fetch("https://api.deflect.bot/verify", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    api_key: "YOUR_API_KEY", // Secret - backend only
    action_id: "YOUR_ACTION_ID", // Safe to share
    token: token_from_frontend,
  }),
});

// Frontend code
Deflect.configure({ actionId: "action_abc123" });
const token = await Deflect.getToken();

fetch("/api/login", {
  method: "POST",
  body: JSON.stringify({
    username: "[email protected]",
    password: "password123",
    deflect_token: token, // Send token to backend
  }),
});

// Backend code (Node.js example)
app.post("/api/login", async (req, res) => {
  const { username, password, deflect_token } = req.body;

  // Verify token with Deflect
  const verification = await fetch("https://api.deflect.bot/verify", {
    method: "POST",
    body: JSON.stringify({
      api_key: process.env.DEFLECT_API_KEY, // From environment
      action_id: "action_abc123",
      token: deflect_token,
    }),
  });

  const result = await verification.json();

  if (!result.verdict.can_pass) {
    return res.status(403).json({ error: "Bot detected" });
  }

  // Continue with login logic...
});

# .env file (backend)
DEFLECT_API_KEY=DFL-XXXX-XXXXXX-XXXXX

// Backend usage
const apiKey = process.env.DEFLECT_API_KEY;

// Frontend configuration (can be in public code)
Deflect.configure({
  actionId: "action_abc123", // This is safe to hardcode
});