Quickstart

npm install @abxy/foil-server

pip install foil-server

go get github.com/abxy-labs/foil-server-go

gem install foil-server

composer require abxy/foil-server

const { safeVerifyFoilToken } = require("@abxy/foil-server");

app.post("/api/signup", async (req, res) => {
  const result = safeVerifyFoilToken(
    req.body.foil.sealedToken,
    process.env.FOIL_SECRET_KEY,
  );

  if (!result.ok || result.data.decision.verdict === "bot") {
    return res.status(403).json({ error: "Blocked" });
  }

  // Proceed with signup
  createAccount(req.body);
  res.json({ success: true });
});

from foil_server import safe_verify_foil_token
import os

@app.post("/api/signup")
def signup(request):
    result = safe_verify_foil_token(
        request.json["foil"]["sealedToken"],
        os.environ["FOIL_SECRET_KEY"],
    )

    if not result.ok or result.data.decision.verdict == "bot":
        return {"error": "Blocked"}, 403

    create_account(request.json)
    return {"success": True}

import foil "github.com/abxy-labs/foil-server-go"

func signupHandler(w http.ResponseWriter, r *http.Request) {
    var body SignupRequest
    json.NewDecoder(r.Body).Decode(&body)

    result := foil.SafeVerifyFoilToken(
        body.Foil.SealedToken,
        os.Getenv("FOIL_SECRET_KEY"),
    )
    if !result.OK || result.Data.Decision.Verdict == "bot" {
        http.Error(w, "Blocked", 403)
        return
    }

    createAccount(body)
    json.NewEncoder(w).Encode(map[string]bool{"success": true})
}

require "foil/server"

post "/api/signup" do
  body = JSON.parse(request.body.read)
  result = Foil::Server::SealedToken.safe_verify_foil_token(
    body.dig("foil", "sealedToken"),
    ENV.fetch("FOIL_SECRET_KEY"),
  )

  if !result[:ok] || result[:data][:decision][:verdict] == "bot"
    halt 403, { error: "Blocked" }.to_json
  end

  create_account(body)
  { success: true }.to_json
end

use Foil\Server\SealedToken;

$body = json_decode(file_get_contents("php://input"), true);
$result = SealedToken::safeVerify(
    $body["foil"]["sealedToken"],
    getenv("FOIL_SECRET_KEY"),
);

if (!$result->ok || $result->data->decision["verdict"] === "bot") {
    http_response_code(403);
    echo json_encode(["error" => "Blocked"]);
    exit;
}

createAccount($body);
echo json_encode(["success" => true]);

# Alternatively, fetch the session from the API instead of verifying locally:
curl https://api.usefoil.com/v1/sessions/sid_... \
  -H "Authorization: Bearer sk_live_..."