Installation
Installation
CDN (Script Tag)
Quick Start
Configuration
Initialization throws an error if:
projectIdis missing or emptypublicKeyis not a valid PEM string- The page is not served over HTTPS or localhost
Methods
client.createSession()
Collects fingerprint, encrypts it with hybrid RSA-OAEP + AES-256-GCM, and sends it to the Antifraud API.
SessionResult:
Concurrent calls are deduplicated — only one in-flight request at a time.
Error Handling
All errors are typed classes extendingAntifraudClientError.
Recommended fail-open pattern:
Exports
Content Security Policy
Add these directives to your CSP:Browser Support
Requires
crypto.subtle (HTTPS or localhost).
Encryption
The SDK uses hybrid encryption:- AES-256-GCM for payload encryption (random key per call)
- RSA-OAEP/SHA-256 to encrypt the AES key
- Each request produces unique ciphertext
CryptoKey is cached across calls to avoid repeated key imports.
