Node and browser SDKs

Node evaluations

Choose throw, allow, or deny for local technical outages. Local outage results are labeled source: local_outage and have no Veltor evaluation ID. Invalid credentials and invalid requests still throw. Skipped results have source: veltor and status: skipped; they never use your outage fallback. Handle this branch before reading result.

import { Veltor } from "@veltor/node";
const veltor = new Veltor({
  key: process.env.VELTOR_SECRET_KEY!,
  outage: "throw"
});
const result = await veltor.evaluate({
  "benefit": "signup_credits",
  "claim_id": "signup_customer_123",
  "subject": {
    "external_id": "customer_123",
    "email": "alex@example.com",
    "email_verified": true
  },
  "context": {"ip": "192.0.2.10"}
}, "attempt_customer_123");
if ("status" in result && result.status === "skipped") {
  // Continue signup only if that is your explicit product choice.
  // There is no evaluation ID or policy decision in this branch.
  console.info("Evaluation skipped", result.reason);
} else {
  // Map allow or deny to your own product workflow.
  console.info(result.result);
}

Server-only hashing

createPhoneHash() and createCustomIdentifier() use deterministic, domain-separated HMAC-SHA256. Keep their secret in your backend and separate from Veltor API keys.

Optional browser observation

The browser SDK runs only when enabled and when your consent callback returns true. It returns a short-lived token that the browser sends to your backend; your backend includes that token in the evaluation request.

When browser scripts are blocked

Continue with the server-side evaluation request and omit the device token. Email, IP, payment, phone, custom identifiers, and history remain available when supplied. Veltor does not fabricate a browser fingerprint on the server.