Defend against bots, fraud, and abuse.

_castle('createRequestToken').then(function(requestToken) { // Insert requestToken into the form data // .... }); // or use onsubmit handler to automatically insert the castle_request_token hidden input <form onsubmit="_castle('onFormSubmit', event)"> // .... </form>

const requestTokenHeaderName = await Castle.requestTokenHeaderName(); const requestToken = await Castle.createRequestToken(); let requestHeaders = new Headers(); requestHeaders.append(requestTokenHeaderName, requestToken);

const requestTokenHeaderName = await Castle.requestTokenHeaderName; const requestToken = await Castle.createRequestToken; Map<String, String> requestHeaders = {}; requestHeaders[requestTokenHeaderName] = requestToken;

token = request.params['castle_request_token'] context = Castle::Context::Prepare.call(request) res = castle.risk( event: '$login', status: '$succeeded', request_token: token, context: { ip: context[:ip], headers: context[:headers] } user: { id: user.id, email: user.email } )

$token = $_POST['castle_request_token']; $res = Castle::risk([ 'event' => '$login', 'status' => '$succeeded', 'request_token' => $token, 'context' => [ 'ip' => Castle_RequestContext::extractIp(), 'headers' => Castle_RequestContext::extractHeaders() ], 'user' => [ 'id' => user->id, 'email' => user->email ] ]);

token = request.form['castle_request_token'] # Using Flask client = Client() context = ContextPrepare.call(request) res = client.risk({ 'event': '$login', 'status': '$succeeded', 'request_token': token, 'context': { 'ip' : context['ip'], 'headers' : context['headers'] }, 'user': { 'id': user.id, 'email': user.email } })

String token = request.getParameter("castle_request_token"); Castle castle = Castle.initialize(); CastleContextBuilder context = castle.contextBuilder().fromHttpServletRequest(request) Verdict res = castle.risk( ImmutableMap.builder() .put("event", "$login") .put("status", "$succeeded") .put("request_token", token) .put("context", ImmutableMap.builder() .put("ip", context.getIp()) .put("headers", context.getHeaders()) .build() .put("user", ImmutableMap.builder() .put("id", user.getId()) .put("email", user.getEmail()) .build() .build() )

const token = request.body["castle_request_token"]; // Using Express const context = ContextPrepareService.call(request, {}, castle.configuration); const res = castle.risk({ event: '$login', status: '$succeeded', request_token: token, user: { id: user.id, email: user.email }, context: { ip: context.ip, headers: context.headers } });

var token = Request.Params["castle_request_token"]; var res = await castleClient.Risk(new ActionRequest() { Event = "$login", Status = "$succeeded", RequestToken = token, Context = new Dictionary<string, string>() { ["ip"] = Request.HttpContext.Connection.RemoteIpAddress.ToString(), ["headers"] = Request.Headers.ToDictionary(x => x.Key, y => y.Value.FirstOrDefault()) }, User = new Dictionary<string, string>() { ["id"] = user.Id, ["email"] = user.Email, ["registered_at"] = user.RegisteredAt } });

API Response

Risk-based scoring

Use risk scores and signals to detect malicious behavior. Take action based on policy verdicts: allow, challenge or deny.

The /risk endpoint assesses each user accessing your site.

Response

{
  "risk": 0.67,
  "signals": {
    "new_device": {},
    "new_country": {},
    "proxy_ip": {},
    "impossible_travel": {},
    "multiple_accounts_per_device": {}
  },
  "policy": {
    "action": "challenge",
    "name": "Step up MFA on suspicious logins",
    "id": "e14c5a8d-c682-4a22-bbca-04fa6b98ad0c",
    "revision_id": "b5cf794e-88c0-426e-8276-037ba1e7ceca"
  },
  "device": {
    "token": "eyJhbGciOiJIUzI1NiJ9.eyJ0b2tlbiI6IlQyQ"
  }
}

{
  "risk": 0.67,
  "signals": {
    "new_device": {},
    "new_country": {},
    "proxy_ip": {},
    "impossible_travel": {},
    "multiple_accounts_per_device": {}
  },
  "policy": {
    "action": "challenge",
    "name": "Step up MFA on suspicious logins",
    "id": "e14c5a8d-c682-4a22-bbca-04fa6b98ad0c",
    "revision_id": "b5cf794e-88c0-426e-8276-037ba1e7ceca"
  },
  "device": {
    "token": "eyJhbGciOiJIUzI1NiJ9.eyJ0b2tlbiI6IlQyQ"
  }
}

{
  "risk": 0.67,
  "signals": {
    "new_device": {},
    "new_country": {},
    "proxy_ip": {},
    "impossible_travel": {},
    "multiple_accounts_per_device": {}
  },
  "policy": {
    "action": "challenge",
    "name": "Step up MFA on suspicious logins",
    "id": "e14c5a8d-c682-4a22-bbca-04fa6b98ad0c",
    "revision_id": "b5cf794e-88c0-426e-8276-037ba1e7ceca"
  },
  "device": {
    "token": "eyJhbGciOiJIUzI1NiJ9.eyJ0b2tlbiI6IlQyQ"
  }
}

{
  "risk": 0.67,
  "signals": {
    "new_device": {},
    "new_country": {},
    "proxy_ip": {},
    "impossible_travel": {},
    "multiple_accounts_per_device": {}
  },
  "policy": {
    "action": "challenge",
    "name": "Step up MFA on suspicious logins",
    "id": "e14c5a8d-c682-4a22-bbca-04fa6b98ad0c",
    "revision_id": "b5cf794e-88c0-426e-8276-037ba1e7ceca"
  },
  "device": {
    "token": "eyJhbGciOiJIUzI1NiJ9.eyJ0b2tlbiI6IlQyQ"
  }
}

Risk and signals

Analyze user risk on any page

Risk scores go up when signals trigger. Take action based on the score or individual signals.

30+ external risk signals
200+ internal risk assessments

Policies

Fine-tune what to allow, challenge, or deny

Take action based on configurable policies rather than hard-coded values.

Trigger on risk, device, location, traits
Decouple risk logic from your code

For Developers

Flexible building blocks

Create custom fraud protection workflows.

Use Cases

Reduce fraud and abuse

Detect suspicious activity. Stop malicious users.

Account takeover

Stop accounts with leaked credentials from being taken over.

Transaction fraud

Prevent fraudulent transactions and money laundering before they happen.

Fake accounts

Mitigate new account registration fraud and fake spam accounts.

Promotion abuse

Prevent fraudsters from taking advantage of rewards, sales or other promotions.

Money laundering

Verify suspicious transaction behaviors such as excessive cash deposits or transfers.

Account sharing

Uncover accounts shared by multiple individuals.