Skip to main content

Installing Tripwire

Tripwire is a lightweight, framework-agnostic JavaScript snippet that provides real-time proxy and bot detection for your website. Adding it to your website is as simple as adding a javascript snippet. Start detecting anonymized threats on your website within minutes following the instructions below.

API Keys​

Before implementing Tripwire, you'll need to obtain your API keys from the Layer3 Intel dashboard:

  • Public Key: Passed to the embedded snippet to activate Tripwire on your website
  • Private Key: Used for API based token decryption
  • Decryption Key: Used to decrypt the tripwire assessment directly on your server

You can find your API keys at: https://layer3intel.com/dashboard/tripwire

Quick Start​

1. Add the Script​

Add the Tripwire script to your website using a standard script tag. The script can be loaded with your preferred loading strategy:

<script src="https://cdn.layer3intel.com/tripwire.min.js?key=YOUR_API_KEY"></script>

2. Run Detection and Get Token​

The simplest way to use Tripwire is to call the detection function and use the returned token in your form submissions:

const tripwireResult = await window.Tripwire.run();

3. Submit Token with Form​

Pass the encrypted token to your backend for validation:

async function handleFormSubmit(formData) {
  const tripwireResult = await window.Tripwire.run();
  
  const payload = {
    ...formData,
    tripwire_token: tripwireResult.token
  };
  
  // Submit to your backend
  await fetch('/api/submit', {
    method: 'POST',
    body: JSON.stringify(payload),
    headers: { 'Content-Type': 'application/json' }
  });
}

4. Decrypt Token on Backend​

After receiving a form submission with the tripwire token you can decrypt it using standard JWE libraries and the decryption key obtained from your dashboard:

import { importPKCS8, jwtDecrypt } from 'jose';

async function decrypt(encryptedPayload, privateKeyPEM) {
  const privateKey = await importPKCS8(privateKeyPEM, 'ECDH-ES');
  const { payload } = await jwtDecrypt(encryptedPayload, privateKey);
  return payload;
}

const privateKeyPEM = `-----BEGIN PRIVATE KEY-----
MIGaAgEAMBMGByqGSA49AgEGCCqGSM49AwEHBG0wawIKAQQgP8gsrfq+XU/QVRW2
OX7xT/TOd/rumKhgQmJ6d+psTHOhRANCJAQb+Q8u/FVhRfcjZ9oW342S5FjEm2nH
+a8Hw+cvT+F0dR67yeA7r+QyA20fv029s0vtjTYJ69h7w6qFaCDVsG+J
-----END PRIVATE KEY-----`;

const encryptedPayload = `eyJhbGciOiJFQ0RpLUVTIiwiZW5jIjoiQTI1MkdDTSIsImVwayI6eyJjcnYiciJQLTI1NiIsImt0eSIKIkVDIiwieCI6IkExVUNDbHNqaWM2ZVZRNVVweHJ2Z282aUNRdWVOOEUnVzh0VlJRX2d4aTliLCJ5IjoiUDdhcWJIZmlFWEw0UVlYVXQ2SEpPWlpjaUY5STRFbmpKdWRaSUJzV1cyeSJ4fQ..HWfQajr6hKE8DRew.1lBUuf_6SrkWGbi5vHNozvlp2UHCXKfBhTb6s9ITt9mIj-HpM9mkeEdULh9Y4_GJ_jlNpgji1sngFnM3qwGabkm7cf23Fj3nGY3MBBKyfWqLffyptUmnaoZdemVJXCEcertzd9orBLc_xjXLAZOOEQ8-1ce1tKQX8c29pzYAKXTsYwd7zGrq_A.eYfdDJp8RiwcJdVmB1M26w`;

const result = await decrypt(encryptedPayload, privateKeyPEM);

Alternatively, you can use the decryption API with the private API key from your dashboard:

const response = await fetch('https://tripwire.layer3intel.com/decrypt', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    key: privateToken,
    payload: req.body.payload,
  }),
});

Configuration Options​

The script accepts several URL parameters for configuration:

  • key: Your API key (required)
  • auto: Set to "true" for automatic detection on page load or "form" to run on form submissions
  • field: Hidden form field name for automatic token insertion (must be set to auto-inject on form submission)
  • forms: CSS selector for forms to monitor (default: "form[data-tripwire]")

Usage Examples​

Manual Detection​

// Run detection manually
const result = await window.Tripwire.run();
if (result.status === 'success') {
  console.log('Detection completed in', result.elapsedMs, 'ms');
  // Use result.token for validation
}

Automatic Form Integration​

<script
  src="https://cdn.layer3intel.com/tripwire.min.js?key=YOUR_API_KEY&auto=form&field=tripwire_token"></script>

<!-- Form will automatically include tripwire_token field -->
<form data-tripwire>
  <input type="email" name="email" />
  <input type="password" name="password" />
  <button type="submit">Submit</button>
</form>

Event Handling​

// Listen for detection events
window.Tripwire.on('tripwire:success', (event) => {
  console.log('Detection successful:', event.detail);
});

window.Tripwire.on('tripwire:error', (event) => {
  console.log('Detection failed:', event.detail.error);
});