Express · Docs — BlockAlt

Add the script, a hidden blockalt-token field and a submit handler in a static file (no inline script needed):

HTML

<script src="https://blockalt.click/v1/assets/blockalt.c8b2d9539dbbc932999adb0f51a36bddd4e99899f543e1505818841878cf9813.js"
  integrity="sha384-pblByFDqcJxRfhDh18GH3gRsWy9ZaS4AjDc6OpozzQqvkuYvyin+4BWcKXxA+bN8"
  crossorigin="anonymous"></script>
<script src="/js/signup.js" defer></script>

<form id="signup" method="post" action="/signup">
  <input name="email" type="email" required>
  <input name="blockalt-token" type="hidden">
  <button>Create account</button>
  <p class="error" role="alert"></p>
</form>

js/signup.jsJavaScript

const protection = BlockAlt.create({
  siteKey: "ba_pk_your_public_site_key",
  apiUrl: "https://blockalt.click",
  // Every key of GET /v1/keys (configPublicKeys), standby keys included.
  configPublicKeys: ["MCowBQYDK2VwAyEAXmYdcBh/jf+z+0H+hs2QvZ9UG4PBgkRvHX/JuXyjIL8=","MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE34qdEtOeD21+CmmfTmFyRr/vySsY1TD6BJZFtwF37pkelvN2vRYWWHdLrUouzkQXEfnA7V50xK2QcmnBCGsxbA==","MCowBQYDK2VwAyEAtkfghYcdvSRf2wA01gjQtgTqdYGjaDUZsOPXzgLnnT0=","MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYYmQNAMnVKK7G3VVguAk3SC/RFT5SDjCoxcFMOPFx0vmsGycJWOK8hCdxuTCHlvShng1fo0y4Q9PJHPIGQ9EfA=="],
});
const form = document.querySelector("#signup");
form.addEventListener("submit", async (event) => {
  event.preventDefault();
  try {
    // A fresh token for every attempt: single use, valid for 120 seconds.
    form.elements["blockalt-token"].value = await protection.execute("signup");
    form.submit();
  } catch {
    form.querySelector(".error").textContent = "Please try again.";
  }
});

Middleware #

blockalt.jsJavaScript

import { createVerifier } from "@blockalt/server"; // or use the fetch helper from the snippets

export function requireBlockAlt(action) {
  const verify = createVerifier({
    apiUrl: "https://blockalt.click",
    secret: process.env.BLOCKALT_SECRET,
    hostname: "example.com",
    action,
  });
  return async (req, res, next) => {
    const token = req.body?.["blockalt-token"] ?? req.get("BlockAlt-Token") ?? "";
    const result = await verify(String(token));
    if (!result.success) {
      console.warn("blockalt refused", { action, reason: result.reason, id: result.id });
      return res.status(403).send("Please try again.");
    }
    next();
  };
}

app.jsJavaScript

import express from "express";
import { requireBlockAlt } from "./blockalt.js";

const app = express();
app.set("trust proxy", "loopback"); // only if a local reverse proxy sets the client address
app.post("/signup", express.urlencoded({ extended: false, limit: "16kb" }), requireBlockAlt("signup"), (req, res) => {
  // …create the account
  res.redirect(303, "/welcome");
});