Guides
React Native
Protect React Native signup and login through your backend and the AbuseGraph session and check APIs.
Keep the secret on your backend
The React Native app must never contain an sk_ key. Send account and device identifiers to an endpoint you own. Your backend uses the secret key to create a short-lived AbuseGraph session, then checks the account against that session.
App request
const response = await fetch("https://your-api.example.com/signup-risk-check", {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({
email,
event: "signup",
visitorId,
fingerprint,
}),
});
const result = await response.json();
if (!response.ok) {
// Show a generic blocked/step-up message. Do not create an account locally.
return;
}
// Continue only after your backend has approved the request and created the account/session.Backend flow
Use your server-held secret for both calls. Store device fields with the session; pass its returned sessionId to the check.
const headers = {
"content-type": "application/json",
"x-api-key": process.env.ABUSEGRAPH_SECRET_KEY!,
"x-abusegraph-site": process.env.ABUSEGRAPH_SITE!,
};
const site = process.env.ABUSEGRAPH_SITE!;
const sessionResponse = await fetch("https://abusegraph.com/api/v1/session", {
method: "POST",
headers,
body: JSON.stringify({ visitorId, fingerprint }),
});
if (!sessionResponse.ok) throw new Error("Unable to create risk session");
const { sessionId } = await sessionResponse.json();
const checkResponse = await fetch("https://abusegraph.com/api/v1/check", {
method: "POST",
headers,
body: JSON.stringify({ email, event, site, sessionId }),
});
if (!checkResponse.ok) throw new Error("Unable to check account risk");
const result = await checkResponse.json();
if (result.verdict === "block") return Response.json({ ok: false }, { status: 403 });
if (result.verdict === "challenge") return Response.json({ ok: false }, { status: 428 });
// Create the account / issue the session here, after the decision.
return Response.json({ ok: true });The session expires after 24 hours. Use iOS and Android for native app notes.