Guardian Web
@surtai/guardian-web runs Guardian's device-intelligence collect() flow in any modern
browser. It gathers device signals, encrypts them locally, and returns an opaque payload
your backend forwards to Surt's evaluate endpoint. There is no API key in the
browser and, unless you opt into the public-IP lookup, no network calls.
Web is intentionally lean and collect-only - there is no verify() or initialize().
Customer binding, transaction metadata, and risk decisions all happen server-side. For the
native SDKs (iOS / Android / React Native), see Guardian native.
Start here
- NPM Package - install,
collect(), options, the backend evaluate flow, errors, and framework examples. - Migrating v0.4 → v0.5 - what changed in v0.5.0 (automatic device recognition + SDK version reporting) and the optional backend step.
The shared backend contract
The evaluate request/response, transaction_type values, config options, error codes, and
the JWT/preflight auth model are identical across every Guardian SDK. Those references
live under Guardian native and apply verbatim to web: