Quick start: protect a form and verify its token

<script src="https://api.antisy.com/v1/i/l.js"
        data-site="VOTRE_CLE_DE_SITE" defer></script>

<form method="post" action="/contact">
  <input name="name" autocomplete="name">
  <input name="email" type="email" autocomplete="email">
  <textarea name="message"></textarea>
  <button>Envoyer</button>
</form>

#!/bin/sh
# ANTISY_SECRET: your verification secret, in the environment, never hard-coded.
# ANTISY_TOKEN:  the antisy-token field received with the form.
# Exit 0: accepted. Exit 2: refused, or submission not verified.
LC_ALL=C

# 1. A token that is there must have the shape of a token: 1 to 2048 printable ASCII characters.
#    Otherwise Antisy is not called and nothing is let through.
if [ -n "$ANTISY_TOKEN" ]; then
  case "$ANTISY_TOKEN" in
    *[!\ -~]*) echo "Jeton mal formé, envoi non vérifié" >&2; exit 2 ;;
  esac
  if [ "$(( $(printf '%s' "$ANTISY_TOKEN" | wc -c) ))" -gt 2048 ]; then
    echo "Jeton trop long, envoi non vérifié" >&2; exit 2
  fi
fi

# 2. The call. The secret goes through standard input: it does not appear in the list of processes.
body=$(printf 'secret=%s' "$ANTISY_SECRET" | curl -sS --max-time 3 -w '\n%{http_code}' \
  https://api.antisy.com/v1/siteverify \
  -d @- \
  --data-urlencode response="$ANTISY_TOKEN")
curl_status=$?
http_code=$(printf '%s' "$body" | tail -n1)

# 3. Let through only when Antisy does not answer: network failure, deadline exceeded, 5xx.
#    The 429 too, by default: see the page on verification before keeping this choice.
if [ "$curl_status" -ne 0 ] || [ "$http_code" -ge 500 ] || [ "$http_code" = 429 ]; then
  echo "Antisy ne répond pas (curl $curl_status, HTTP $http_code), envoi laissé passer" >&2
  exit 0
fi
# Any other error status is a fault of your call: to be fixed, and never a pass.
if [ "$http_code" -ge 400 ]; then
  echo "Requête refusée par Antisy (HTTP $http_code), envoi non vérifié" >&2
  exit 2
fi

# 4. Compact JSON response: grep is enough here, use a real JSON parser in your code.
if printf '%s' "$body" | grep -q '"success":true'; then
  exit 0   # visitor accepted
else
  exit 2   # deny: generic refusal, without saying why
fi

// antisy.mjs: Node 22 or later, no dependency.
// Returns "allow" or "deny".
// Antisy does not answer (network, deadline, 5xx): "allow". Everything else that is uncertain: "deny".

// The 429 is a decision that is yours. "allow" by default, as for an outage;
// for a sensitive form, set "deny" (see the page on verification).
const ON_RATE_LIMIT = "allow";

export async function antisyVerdict(token) {
  // 1. A token that is there must have the shape of a token: 1 to 2048 printable ASCII characters.
  //    Otherwise, Antisy is not called and nothing is let through.
  //    An empty or missing field (script blocked) is sent as an empty string: Antisy reads it as a missing token.
  if (token && !/^[\x20-\x7e]{1,2048}$/.test(token)) {
    console.warn("Jeton mal formé, envoi non vérifié");
    return "deny";
  }

  let response;
  try {
    response = await fetch("https://api.antisy.com/v1/siteverify", {
      method: "POST",
      // fetch follows redirects by default: a 3xx would replay the body, secret included, elsewhere.
      // Here it is an error of your call (refused below).
      redirect: "manual",
      // A URLSearchParams body is sent as application/x-www-form-urlencoded.
      body: new URLSearchParams({
        secret: process.env.ANTISY_SECRET, // your secret, never in the page
        response: token ?? "",             // the antisy-token field, as received
      }),
      signal: AbortSignal.timeout(3000),   // beyond 3 s, Antisy does not answer
    });
  } catch (error) {
    console.warn("Antisy injoignable, envoi laissé passer :", error.name);
    return "allow";
  }
  if (response.status >= 500) {
    console.warn("Antisy a répondu " + response.status + ", envoi laissé passer");
    return "allow";
  }
  if (response.status === 429) {
    console.warn("Antisy a répondu 429, décision : " + ON_RATE_LIMIT);
    return ON_RATE_LIMIT;
  }
  if (!response.ok) {
    // 400, 401, 413, 415...: the fault is in your call. To be fixed, never a pass.
    console.error("Antisy a refusé la requête (" + response.status + "), envoi non vérifié");
    return "deny";
  }
  const result = await response.json().catch(() => null);
  if (typeof result?.success !== "boolean") {
    console.error("Réponse d'Antisy illisible, envoi non vérifié");
    return "deny";
  }
  // A missing or refused secret is not an HTTP error: the response is a refusal, with a 200.
  const codes = result["error-codes"] ?? [];
  if (codes.includes("missing-input-secret") || codes.includes("invalid-input-secret")) {
    console.error("Antisy refuse le secret : " + codes.join(", "));
  }
  // success is the only acceptance: it is true if and only if verdict is "allow".
  return result.success ? "allow" : "deny";
}

import { antisyVerdict } from "./antisy.mjs";

// In the handler of your form, after parsing the body:
const verdict = await antisyVerdict(body["antisy-token"]);
if (verdict === "deny") return refuse(); // generic refusal, without saying why
return accept();