Castle analyzes device, location, and interaction patterns in your web and mobile apps and lets you stop account takeover attacks in real-time..

Official Castle docs

Add the @castleio/sdk package to your package.json.

yarn add @castleio/sdk

npm install --save @castleio/sdk

Load and configure the library with your Castle API secret in an initializer or similar.

import { Castle } from '@castleio/sdk';

const castle = Castle({ apiSecret: 'YOUR SECRET HERE' });

The castle instance exposes two methods, track and authenticate. In order to provide the information required in both these methods, you'll need access to the logged in user information (if that is available at that stage in the user flow), as well as request information. In node connect/express, the user is often found in the session object, or directly on the request object in the user property, if you are using passport.

This is the asynchronous version of the castle integration. This is for events where you don't require a response.

import { EVENTS } from '@castleio/sdk';

track({
  event: EVENTS.EMAIL_CHANGE_SUCCEEDED,
  user_id: user.id,
  user_traits: {
    email: user.email,
    registered_at: user.registered_at,
  },
  context: {
    ip: request.ip,
    client_id: request.cookies['__cid'],
    headers: request.cookies,
  },
});

This is the synchronous version of the castle integration. This is for events where you require a response. It is used in the same way as track, except that you have the option of waiting for a response.

let response;
try {
  const response = await castle.authenticate({
    event: EVENTS.EMAIL_CHANGE_SUCCEEDED,
    user_id: user.id,
    user_traits: {
      email: user.email,
      registered_at: user.registered_at,
    },
    context: {
      ip: request.ip,
      client_id: request.cookies['__cid'],
      headers: request.headers,
    },
  });
} catch (e) {
  console.error(e);
}

console.log(response); // { "action": "allow", "user_id": 123, "device_token": "eyj...." }

Response format