Docs

Quickstart

Set up environment-specific Shield configuration without exposing secrets to the browser.

Details

Clear claims, explicit boundaries

1. Create environment variables

Configure server-only variables such as SHIELD_API_URL, SHIELD_API_KEY and SHIELD_ENVIRONMENT in each backend environment. Do not prefix secrets with NEXT_PUBLIC_.

2. Choose failure behavior

Fail-closed blocks the protected action when Shield is unavailable. Fail-open allows limited continuation and should be reserved for flows where availability risk outweighs abuse risk.

3. Log decisions

Record request IDs and decision outcomes in your own application logs without storing unnecessary personal data.

SHIELD_API_URL=https://api.example.invalid
SHIELD_API_KEY=server-only-value
SHIELD_ENVIRONMENT=staging
SHIELD_FAILURE_MODE=fail-closed