Bot protection.
Any website.

curl https://network.getropeline.com/v1/check \
  -H "X-Ropeline-Key: RL-XXXXX-XXXXX-XXXXX-XXXXX" \
  -H "Content-Type: application/json" \
  -d '{"site": "example.com", "event": "login", "ip": "203.0.113.7"}'

import { createRopeline } from "./ropeline.js";
const ropeline = createRopeline({ key: process.env.ROPELINE_KEY, site: "example.com" });

app.post("/login", async (req, res) => {
  const verdict = await ropeline.check("login", { ip: req.ip }); // behind a proxy: app.set("trust proxy", true)
  if (verdict.action === "block") return res.status(429).send("Too many tries. Please wait an hour.");
  if (verdict.action === "challenge" && !captchaPassed(req)) return showCaptcha(res);
  if (!(await passwordIsRight(req.body))) {
    await ropeline.failed("login", { ip: req.ip });
    return res.status(401).send("Wrong email or password.");
  }
  // ...log them in
});

function ropeline_check($event, $ip, $failed = false, $email = '') {
    $ch = curl_init('https://network.getropeline.com/v1/check');
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT_MS => 1500,
        CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'X-Ropeline-Key: ' . getenv('ROPELINE_KEY')],
        CURLOPT_POSTFIELDS => json_encode(['site' => 'example.com', 'event' => $event, 'ip' => $ip, 'failed' => $failed, 'email' => $email]),
    ]);
    $answer = json_decode((string) curl_exec($ch), true);
    return is_array($answer) && isset($answer['action']) ? $answer['action'] : 'allow';
}

if (ropeline_check('signup', $_SERVER['REMOTE_ADDR'], false, $_POST['email']) === 'block') {
    http_response_code(429);
    exit('Too many signups from your connection. Please try again later.');
}

import os, requests

def ropeline_check(event, ip, failed=False, email=""):
    try:
        r = requests.post("https://network.getropeline.com/v1/check", timeout=1.5,
                          headers={"X-Ropeline-Key": os.environ["ROPELINE_KEY"]},
                          json={"site": "example.com", "event": event, "ip": ip, "failed": failed, "email": email})
        return r.json().get("action", "allow")
    except requests.RequestException:
        return "allow"

# After a declined payment (card testing shows up as many of these from one address):
ropeline_check("checkout", request.remote_addr, failed=True)