@sekyuriti/attest

API protection for Next.js applications. Verify that requests come from real browsers, not bots or scripts.

Quick Start

One command setup:

npx @sekyuriti/attest login

This will:

1. Open browser for authentication
2. Let you select your project
3. Auto-add environment variables to .env.local
4. Auto-inject the ATTEST script into layout.tsx

Done. Your API is protected.

What It Does

• Frontend script automatically signs all fetch() and XMLHttpRequest calls
• Backend verification validates signatures with SEKYURITI's API
• Bots and scripts can't generate valid signatures without running in a real browser

Optional: Middleware

Add server-side verification for all API routes:

// middleware.ts
import { createAttestMiddleware } from "@sekyuriti/attest/middleware";

export const middleware = createAttestMiddleware({
  projectId: process.env.NEXT_PUBLIC_ATTEST_KEY!,
  apiKey: process.env.ATTEST_SECRET_KEY!,
});

export const config = {
  matcher: "/api/:path*",
};

Optional: Per-Route Verification

// app/api/protected/route.ts
import { verifyAttest } from "@sekyuriti/attest";

export async function POST(request: Request) {
  const result = await verifyAttest(request, {
    projectId: process.env.NEXT_PUBLIC_ATTEST_KEY!,
    apiKey: process.env.ATTEST_SECRET_KEY!,
  });

  if (!result.attested) {
    return Response.json({ error: "Not attested" }, { status: 403 });
  }

  // Handle request...
}

CLI Commands

attest login     # Authenticate and setup project
attest logout    # Sign out
attest status    # Show account and usage info
attest init      # Re-run setup in current project
attest whoami    # Print current user email
attest help      # Show help

Environment Variables

Auto-generated by attest login:

NEXT_PUBLIC_ATTEST_KEY=your_public_key
ATTEST_SECRET_KEY=your_secret_key

Protection Features

• DevTools detection
• Bot/headless browser detection
• Request signing with HMAC-SHA256
• Browser fingerprinting
• Timestamp validation

Documentation

https://sekyuriti.build/docs/attest

License

MIT