How to add fraud scoring to an Astro or Cloudflare app

Astro and Cloudflare are a strong fit for lightweight, server-side fraud checks. You can score sensitive requests before they create accounts, checkout sessions, form submissions, or API access.

Install the SDK

import RequestGuard from "@requestguard/js";

const requestGuard = RequestGuard({
  apiKey: process.env.REQUESTGUARD_API_KEY,
});

Keep the API key on the server. Do not expose it to browser code.

Get the client context

In a server endpoint, read trusted edge headers and request metadata:

const ip =
  request.headers.get("cf-connecting-ip") ||
  request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();

const userAgent = request.headers.get("user-agent") || undefined;

Score the event

const assessment = await requestGuard.assess({
  ip,
  email: body.email,
  domain: body.email?.split("@")[1],
  userAgent,
  event: "signup",
  sessionId: body.sessionId,
});

Enforce the decision

Use the decision before writing to the database or calling downstream services.

if (assessment.decision === "block") {
  return new Response("Blocked", { status: 403 });
}

if (assessment.decision === "challenge") {
  return Response.json({ next: "verify" }, { status: 409 });
}

Where to call it

Call RequestGuard before account creation, checkout session creation, contact form submission, coupon redemption, API-key creation, and bulk export jobs.

The integration is small because the fraud decision stays server-side and maps directly to product behavior.