SYK.INIT
v2.0
PROTOCOL.ACTIVE
ENCRYPTED
SEKYURITI
PREPARING ENVIRONMENT
_

AUTHENTICATED POST-DEPLOYMENT CONTROL

DOCUMENTATIONv0.2.3

ATTEST

API protection for Next.js. One script tag on the frontend. One middleware on the backend. Bots blocked.

NPM PACKAGE
NEXT.JS 13+
TYPESCRIPT
*
AI INTEGRATION

TELL YOUR AI

Copy the prompt below and paste it to Claude, ChatGPT, or Cursor to integrate ATTEST automatically.

01

LOGIN

npx @sekyuriti/attest login

02

DONE

Auto-configured

03

PROTECTED

Bots blocked

01

SETUP

One command. Auto-configures everything.

terminalbash
npx @sekyuriti/attest login

WHAT HAPPENS

1.Opens browser for authentication
2.Select your project
3.Auto-adds env vars to .env.local
4.Auto-injects script into layout.tsx

ENVIRONMENT VARIABLES (AUTO-GENERATED)

NEXT_PUBLIC_ATTEST_KEYPublic key for frontend script
ATTEST_SECRET_KEYSecret key for backend verification
02

FRONTEND

Auto-injected by CLI. All fetch() and XMLHttpRequest calls are automatically signed.

HOW IT WORKS

1

Script loads and hooks fetch/XHR

No code changes required

2

Each request is signed with HMAC-SHA256

Timestamp + fingerprint + method + URL

3

Headers added automatically

X-Attest-Timestamp, X-Attest-Signature, X-Attest-Fingerprint

app/layout.tsx (auto-injected)tsx
import Script from "next/script";

export default function RootLayout({
  children,
}: {
  children: React.ReactNode;
}) {
  return (
    <html lang="en">
      <body>
        <Script
          src="https://sekyuriti.build/api/v2/attest/script/YOUR_KEY"
          strategy="beforeInteractive"
        />
        {children}
      </body>
    </html>
  );
}

DETECTION FEATURES

DevTools detection
Headless browser detection
Bot/automation detection
Browser fingerprinting
03

BACKEND

Verify signatures in your API routes. Reject unsigned requests.

app/api/protected/route.tstypescript
import { verifyAttest } from "@sekyuriti/attest";

export async function POST(request: Request) {
  const result = await verifyAttest(request, {
    projectId: process.env.NEXT_PUBLIC_ATTEST_KEY!,
    apiKey: process.env.ATTEST_SECRET_KEY!,
  });

  if (!result.attested) {
    return Response.json(
      { error: "Request not attested", reason: result.reason },
      { status: 403 }
    );
  }

  // Request is verified - proceed with your logic
  // result.fingerprint contains the browser fingerprint

  return Response.json({ success: true });
}

ATTESTED RESPONSE

{
  attested: true,
  fingerprint: "abc123",
  timestamp: 1234567890,
  usage: {
    used: 1234,
    limit: 10000,
    percent: 12
  }
}

BLOCKED RESPONSE

{
  attested: false,
  reason: "Invalid signature"
}

// Possible reasons:
// - Missing ATTEST headers
// - Invalid signature
// - Timestamp expired
// - Invalid API key
04

MIDDLEWARE

Protect all API routes with one file. The recommended approach.

RECOMMENDED
middleware.tstypescript
import { createAttestMiddleware } from "@sekyuriti/attest/middleware";

export const middleware = createAttestMiddleware({
  projectId: process.env.NEXT_PUBLIC_ATTEST_KEY!,
  apiKey: process.env.ATTEST_SECRET_KEY!,
});

export const config = {
  matcher: "/api/:path*",
};

CONFIGURATION OPTIONS

OPTIONTYPEDEFAULT
protectedRoutesstring[]["/api/*"]
excludeRoutesstring[][]
allowUnauthenticatedbooleanfalse
onBlockedfunction403 response
onAllowedfunctionundefined
middleware.ts (advanced)typescript
import { createAttestMiddleware } from "@sekyuriti/attest/middleware";

export const middleware = createAttestMiddleware({
  projectId: process.env.NEXT_PUBLIC_ATTEST_KEY!,
  apiKey: process.env.ATTEST_SECRET_KEY!,

  // Only protect specific routes
  protectedRoutes: ["/api/v1/*", "/api/checkout/*"],

  // Skip health check endpoint
  excludeRoutes: ["/api/health"],

  // Allow requests without headers during rollout
  allowUnauthenticated: false,

  // Custom blocked handler
  onBlocked: (req, result) => {
    console.log("Blocked:", result.reason);
    return Response.json(
      { error: "Access denied" },
      { status: 403 }
    );
  },

  // Log successful attestations
  onAllowed: (req, result) => {
    console.log("Verified:", result.fingerprint);
  },
});

export const config = {
  matcher: "/api/:path*",
};
05

API REFERENCE

All exported functions and types.

verifyAttest()

ASYNC

Verify a single request against the ATTEST API.

async function verifyAttest(
  request: Request,
  config: AttestConfig
): Promise<AttestResult>

// AttestConfig
interface AttestConfig {
  projectId: string;
  apiKey: string;
  verifyUrl?: string; // Optional, for self-hosted
}

// AttestResult
interface AttestResult {
  attested: boolean;
  fingerprint?: string;
  timestamp?: number;
  reason?: string;
  warning?: string;
  usage?: {
    used: number;
    limit: number;
    percent: number;
  };
}

createAttestVerifier()

Create a reusable verifier function with config baked in.

const verify = createAttestVerifier({
  projectId: process.env.NEXT_PUBLIC_ATTEST_KEY!,
  apiKey: process.env.ATTEST_SECRET_KEY!,
});

// Later in your routes
const result = await verify(request);

Helper Functions

getAttestHeaders(request)

Extract ATTEST headers from a request.

hasAttestHeaders(request)

Check if a request has ATTEST headers.

PROTECT YOUR API

One script tag. One middleware. Zero bots.

GET STARTEDVIEW ON NPM