@trustsig/client

Vanilla JavaScript client for TrustSig bot protection. Handles dynamic script injection and token retrieval.

Installation

npm install @trustsig/client

Usage

1. Simple Token Retrieval

By default, the SDK automatically scans the page on load.

import { TrustSigClient } from '@trustsig/client';

const client = new TrustSigClient({ siteKey: 'pk_live_...' });

const response = await client.getResponse(); // { request_id, token } | null

await fetch('/api/action', {
  method: 'POST',
  headers: { 'X-TrustSig-Response': response?.token ?? '' },
  body: JSON.stringify({ data: '...' }),
});

getResponse() and scan() resolve to null on any failure (SSR, script load failure/timeout, or no verdict). Enable debug: true to log the reason.

2. Manual Scanning

If you set autoScan: false, trigger analysis explicitly with scan().

const client = new TrustSigClient({ siteKey: 'pk_live_...', autoScan: false });

const response = await client.scan();
const token = response?.token;

Options

| Option | Type | Default | Description | | --- | --- | --- | --- | | siteKey | string | Required | Your public site key. | | autoScan | boolean | true | Automatically run analysis on load. | | interceptRequests | boolean | false | Auto-inject headers on fetch/XHR. | | debug | boolean | false | Log swallowed errors and timeouts. | | nonce | string | – | CSP nonce for script injection. | | env | PROD \| DEV \| DEMO | PROD | Environment to use. | | customData | Record<string, unknown> | – | Custom metadata for analysis. | | scriptUrl | string | env-derived | Override the SDK script URL. | | scriptTimeoutMs | number | 10000 | Abort script injection if it has not loaded in time. |

The server is the trust boundary — always verify the returned token with @trustsig/server.