為按下確認的那一秒而設計。

export TRUSTLAYER_SECRET_KEY=sk_test_your_key   # secret 金鑰，只放伺服器端

curl -s https://trustlayer-platform-rho.vercel.app/v1/score \
  -H "X-API-Key: $TRUSTLAYER_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "event_type": "TRANSACTION",
    "user": { "user_ref": "member-0007", "phone_number": "+886900000007" },
    "context": { "amount": 10000, "avg_amount_30d": 823.33, "is_new_device": true }
  }'

const res = await fetch("https://trustlayer-platform-rho.vercel.app/v1/score", {
  method: "POST",
  headers: {
    "X-API-Key": process.env.TRUSTLAYER_SECRET_KEY, // sk_test_your_key，只放伺服器端
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    event_type: "TRANSACTION",
    user: { user_ref: "member-0007", phone_number: "+886900000007" },
    context: { amount: 10000, avg_amount_30d: 823.33, is_new_device: true },
  }),
});
const decision = await res.json();
console.log(decision.risk_score, decision.action); // 87 "BLOCK_REVIEW"

import os

import httpx

r = httpx.post(
    "https://trustlayer-platform-rho.vercel.app/v1/score",
    headers={"X-API-Key": os.environ["TRUSTLAYER_SECRET_KEY"]},  # sk_test_your_key，只放伺服器端
    json={
        "event_type": "TRANSACTION",
        "user": {"user_ref": "member-0007", "phone_number": "+886900000007"},
        "context": {"amount": 10000, "avg_amount_30d": 823.33, "is_new_device": True},
    },
)
r.raise_for_status()
decision = r.json()
print(decision["risk_score"], decision["action"])  # 87 BLOCK_REVIEW

<script src="https://trustlayer-platform-rho.vercel.app/sdk/trustlayer.js" data-key="pk_test_your_key"></script>
<script>
  TrustLayer.check({ event: "LOGIN", phone: "0900000001" })
    .then((d) => console.log(d.action, d.message));
</script>

<!-- 或標在表單上：送出前先查，ALLOW、WARN 才送出 -->
<form data-trustlayer-event="LOGIN">
  <input name="phone" />
</form>

POST https://your-shop.example/webhooks/trustlayer
Content-Type: application/json
X-TrustLayer-Event: decision.block_review
X-TrustLayer-Signature: t=1793019912,v1=<HMAC-SHA256 hex>

{
  "type": "decision.block_review",
  "created_at": "2026-10-26T13:05:12.481920+00:00",
  "data": {
    "decision_id": "…",
    "risk_score": 87,
    "action": "BLOCK_REVIEW",
    "reasons": [ … ]
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

// X-TrustLayer-Signature: t=<秒>,v1=<HMAC-SHA256(secret, "t.body")>
export async function POST(request) {
  const body = await request.text(); // 用原始內容驗簽，驗過才 JSON.parse
  const header = request.headers.get("x-trustlayer-signature") ?? "";
  const sig = Object.fromEntries(
    header.split(",").map((p) => [p.slice(0, p.indexOf("=")), p.slice(p.indexOf("=") + 1)]),
  );
  const t = Number(sig.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) {
    return new Response("stale timestamp", { status: 401 });
  }
  const expected = createHmac("sha256", process.env.TRUSTLAYER_WEBHOOK_SECRET) // whsec_your_secret
    .update(`${t}.${body}`)
    .digest();
  const given = Buffer.from(sig.v1 ?? "", "hex");
  if (given.length !== expected.length || !timingSafeEqual(given, expected)) {
    return new Response("bad signature", { status: 401 });
  }
  const event = JSON.parse(body); // event.type === "decision.block_review"
  // event.data：那次 /v1/score 的回應
  return Response.json({ received: true });
}