Documentation

Examples

Common patterns and integrations.

Express: protect login only

Call Guard before heavy auth/db work.

import express from "express";
import { GuardClient } from "@shammy911/guard-sdk";

const app = express();

const guard = new GuardClient({
  baseUrl: process.env.GUARD_BASE_URL!,   // https://guard-api-****.onrender.com
  apiKey: process.env.GUARD_API_KEY!,
});

app.post("/api/login", async (req, res, next) => {
  const decision = await guard.check("/api/login", "POST");
  if (!decision.allowed) return res.status(429).json(decision);
  next();
});

app.listen(3000);

Next.js: protect a route handler

import { GuardClient } from "@shammy911/guard-sdk";

const guard = new GuardClient({
  baseUrl: process.env.GUARD_BASE_URL!,   // https://guard-api-****.onrender.com
  apiKey: process.env.GUARD_API_KEY!,
  failClosed: true,
});

export async function POST() {
  const decision = await guard.check("/api/register", "POST");
  if (!decision.allowed) return new Response("Blocked", { status: 429 });
  return new Response("ok");
}

Fail-open vs fail-closed

For login/auth endpoints, fail-closed is safer.

// fail-closed (recommended)
new GuardClient({ baseUrl: process.env.GUARD_BASE_URL!, apiKey: process.env.GUARD_API_KEY!, failClosed: true });

// fail-open (availability-first)
new GuardClient({ baseUrl: process.env.GUARD_BASE_URL!, apiKey: process.env.GUARD_API_KEY!, failClosed: false });