Protect Login

End-to-end: protect your login endpoint from credential stuffing and automated bot attacks using a passive HCS check, without adding a CAPTCHA step for real users.

1. Initialize the SDK on the login page

import { useEffect, useRef } from 'react'
import { init, type CertiLayerSDK } from '@certilayer/web'

const certilayerRef = useRef<CertiLayerSDK | null>(null)

useEffect(() => {
  certilayerRef.current = init({ apiKey: process.env.NEXT_PUBLIC_CERTILAYER_PK! })
}, [])

2. Attach the session ID to the login request

async function handleLogin(email: string, password: string) {
  const sessionId = certilayerRef.current?.getSessionId() ?? ''
  const res = await fetch('/api/login', {
    method: 'POST',
    body: JSON.stringify({ email, password, certilayer_session: sessionId }),
  })
}

3. Verify server-side before checking credentials

Node.js — api/login

import { CertiLayerClient } from '@certilayer/node'

const certilayer = new CertiLayerClient({ apiKey: process.env.CERTILAYER_SECRET_KEY! })

export async function POST(req: Request) {
  const { email, password, certilayer_session } = await req.json()

  const result = await certilayer.verifySession(certilayer_session)
  if (result.verdict === 'synthetic') { // SDK translates the API's "Synthetic" to this for you
    return Response.json({ error: 'bot_detected' }, { status: 403 })
  }

  // proceed to check credentials as normal
}

✅

This runs entirely in the background — real users never see a challenge. Only sessions scored below the Synthetic threshold get blocked.

ℹ️

For finer control than block/allow (e.g. step-up on borderline scores), configure a policy rule instead of hand-checking the verdict.