SDK
Browser SDK
Publishable key in the browser. collect, evaluate, then toCheckBody on your server with a secret key.
Browser installs use the public CDN script. The deferred script runs before DOMContentLoaded; initialize from that event so the global is ready. The edge URL defaults to https://api.abusegraph.com.
<script src="https://abusegraph.com/sdk/abusegraph.min.js" defer></script>
<script>
let sdk;
function initAbuseGraph() {
if (!window.AbuseGraph) return;
sdk = window.AbuseGraph.init({ publicKey: "pk_test_…" });
}
if (document.readyState === "loading") {
document.addEventListener("DOMContentLoaded", initAbuseGraph, { once: true });
} else {
initAbuseGraph();
}
async function collectForAuth(email, event = "signup") {
if (!sdk) throw new Error("AbuseGraph SDK is not ready");
const collected = await sdk.collect();
const edge = await sdk.evaluate(collected, { email });
return sdk.toCheckBody(collected, {
email,
event,
verdictToken: edge.verdictToken?.token || undefined,
});
}
</script>POST that body from your server to /api/v1/check with sk_…. Keep secret keys server-side; fail-open evaluate responses may omit a verdict token.
Rules
- Only
pk_in the browser. - Call
collectwhile the form is open so behavior has time to accumulate. - Decide at signup/login — not on every pointer move.
- Fail open if the network blips; do not brick registration.
Packages
@abusegraph/sdk
@abusegraph/server
@abusegraph/mobile-client
@abusegraph/sdk-react-native
Native and React Native: Mobile SDKs.
Try evaluate
Browser evaluate is documented under Browser Evaluate (POST /v1/risk/evaluate).