Quickstart

Your HEIP account comes with dashboard access. No account yet? Book a demo.

Name it and add your domains, for example shop.example.com or *.example.com. Turn on Allow localhost for local testing. You get a site key (pk_live_…).

Copy it now: it is shown once. Put it in your server's environment as HEIP_SECRET_KEY.

In Site, then Settings. Nothing will be blocked while you test.

With a script tag, or from npm.

<script src="https://<sdk-host>/sdk.js" data-site-key="pk_live_…" async></script>

import { init, prepareAction } from "heip-sdk";

init({ siteKey: "pk_live_…" });

You should see a GET /v2/ping request succeed in the network tab. If it's refused, the X-HEIP-Reason response header says why, for example domain_not_allowed or invalid_site_key.

Call prepareAction when the form is submitted, and send sessionId and actionNonce with the request.

form.addEventListener("submit", async (e) => {
  e.preventDefault();
  const { sessionId, actionNonce } = await HEIP.prepareAction("checkout");

  await fetch("/api/checkout", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ sessionId, actionNonce, ...formData }),
  });
});

import { HeipServer, allow } from "heip-sdk/server";

const heip = new HeipServer({ secretKey: process.env.HEIP_SECRET_KEY });

const result = await heip.verify({ sessionId, actionNonce, action: "checkout" });
console.log(result.decision, result.mode, result.traceId);

if (!allow(result)) return res.status(403).end();

curl -X POST https://<api-host>/v2/verify \
  -H "X-HEIP-SECRET-KEY: $HEIP_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sessionId":"…","actionNonce":"…","action":"checkout"}'

You should see a response with a decision and "mode": "observe".

Open Site, then Activity, to see the decision and its reasons. Look up a single decision by traceId within the hour.

Pass a built-in policy with policyId. Critical (strict_withdrawal) suits withdrawals and payout changes; Fast (fast_trading) suits order confirmations; Standard (marketplace_standard) suits sign-up and posting; Observe (passive_consumption_observe) never denies.

const result = await heip.verify({
  sessionId,
  actionNonce,
  action: "withdraw",
  policyId: "strict_withdrawal",
});

For about a week. Review decisions and reasons in Activity.

Decide what your app does on STEP_UP: a passkey, a one-time code, a password, or a manual review.