JavaScript SDK

npm install @emblemapp/sdk

import { createClient } from '@emblemapp/sdk'

const emblem = createClient({
  apiKey: process.env.EMBLEM_SECRET_KEY!,
})

import crypto from 'node:crypto'

const { session_id, redirect_url } = await emblem.startVerification({
  integration_id: process.env.EMBLEM_INTEGRATION_ID!,
  callback_url: new URL('/callback', process.env.APP_BASE_URL!).toString(),
  state: crypto.randomBytes(16).toString('hex'), // CSRF protection
})

// Redirect the user's browser
res.redirect(redirect_url)

GET /callback?result_token=emb_rt_...&session_id=emb_sess_...&state=your_csrf_token

const result = await emblem.validateVerification({
  result_token: req.query.result_token,
})

// Grant access — result.level is 'L1' or 'L2'
// Cache this result in your session — tokens are single-use

const emblem = createClient({
  publicKey: 'emb_pk_live_...',
})

const { redirect_url } = await emblem.startVerification({
  integration_id: 'your-integration-id',
  callback_url: 'https://your-site.com/callback',
})

window.location.href = redirect_url

import { verifyWebhookSignature } from '@emblemapp/sdk'

app.post('/webhook', express.raw({ type: '*/*' }), (req, res) => {
  const rawBody = req.body.toString('utf-8')
  const signature = req.headers['x-emblem-signature'] || ''
  const timestamp = req.headers['x-emblem-timestamp'] || ''

  const isValid = verifyWebhookSignature({
    signature,
    timestamp,
    rawBody,
    secret: process.env.EMBLEM_WEBHOOK_SECRET!,
  })

  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' })
  }

  const event = JSON.parse(rawBody)
  res.json({ received: true, type: event.type })
})

import { EmblemApiError } from '@emblemapp/sdk'

try {
  await emblem.startVerification({
    integration_id: process.env.EMBLEM_INTEGRATION_ID!,
    callback_url: 'https://your-site.com/callback',
  })
} catch (err) {
  if (err instanceof EmblemApiError) {
    console.log(err.status)
    console.log(err.code)
    console.log(err.error)
    console.log(err.request_id)
    console.log(err.details)

    if (err.isRateLimited) {
      console.log(err.retryAfter)
    }
  }
}

'use server'

import { createClient } from '@emblemapp/sdk'
import crypto from 'node:crypto'
import { cookies } from 'next/headers'
import { redirect } from 'next/navigation'

const emblem = createClient({
  apiKey: process.env.EMBLEM_SECRET_KEY!,
})

export async function startVerification() {
  const state = crypto.randomBytes(16).toString('hex')

  const { redirect_url } = await emblem.startVerification({
    integration_id: process.env.EMBLEM_INTEGRATION_ID!,
    callback_url: `${process.env.NEXT_PUBLIC_BASE_URL}/api/callback`,
    state,
  })

  // Store state in a cookie for CSRF verification
  const cookieStore = await cookies()
  cookieStore.set('emblem_state', state, {
    httpOnly: true,
    secure: true,
    sameSite: 'lax',
    maxAge: 600, // 10 minutes
  })

  redirect(redirect_url)
}

import { createClient } from '@emblemapp/sdk'
import { cookies } from 'next/headers'
import { redirect } from 'next/navigation'
import { NextRequest } from 'next/server'

const emblem = createClient({
  apiKey: process.env.EMBLEM_SECRET_KEY!,
})

export async function GET(request: NextRequest) {
  const result_token = request.nextUrl.searchParams.get('result_token')
  const state = request.nextUrl.searchParams.get('state')

  if (!result_token) {
    return new Response('Missing result_token', { status: 400 })
  }

  // Verify CSRF state
  const cookieStore = await cookies()
  const expectedState = cookieStore.get('emblem_state')?.value
  if (!state || state !== expectedState) {
    return new Response('State mismatch', { status: 403 })
  }
  cookieStore.delete('emblem_state')

  // Validate the result token (server-side, secret key)
  const result = await emblem.validateVerification({
    result_token,
  })

  // Store verification in your session/database
  // result.level is 'L1' or 'L2'
  redirect('/verified')
}

import 'dotenv/config'
import express from 'express'
import crypto from 'node:crypto'
import { createClient } from '@emblemapp/sdk'

const app = express()
const sessions = new Map()

const emblem = createClient({
  apiKey: process.env.EMBLEM_SECRET_KEY!,
})

// Derive callback URL from environment — never hardcode in production
const callbackUrl = new URL('/callback', process.env.APP_BASE_URL!).toString()

// Start verification
app.post('/verify', async (req, res) => {
  const state = crypto.randomBytes(16).toString('hex')

  const { session_id, redirect_url } = await emblem.startVerification({
    integration_id: process.env.EMBLEM_INTEGRATION_ID!,
    callback_url: callbackUrl,
    state,
  })

  sessions.set(session_id, { state })
  res.redirect(redirect_url)
})

// Handle callback — this is where the user lands after verification
app.get('/callback', async (req, res) => {
  const result_token = req.query.result_token
  const session_id = req.query.session_id
  const state = req.query.state

  if (typeof result_token !== 'string' || !result_token) {
    return res.status(400).send('Missing result_token')
  }
  if (typeof state !== 'string' || !state) {
    return res.status(400).send('Missing state')
  }

  const session = sessions.get(session_id)
  if (!session || state !== session.state) {
    return res.status(403).send('Invalid session or state mismatch')
  }

  const result = await emblem.validateVerification({ result_token })

  // Grant access — result.level is 'L1' or 'L2'
  res.send(`Verified at ${result.level}`)
})

app.listen(3000)