Blursec SDK

Official isomorphic TypeScript SDK for Blursec — answering one question in front of your /login endpoint: “Is this credential already in the wild?”

​

What Blursec does

1. blursec.checkCredential(email, password) — Layer 1. K-anonymity SHA-256 lookup. The raw password never leaves your server.
2. blursec.verifySession(req) — Layer 2. Extracts a session token from a Request, auto-detects JWT vs opaque, hashes appropriately, and looks it up.
3. blursec.webhooks.verify(...) — Verify HMAC-signed deliveries when a previously-clean session shows up in a fresh stealer-log batch after login.
4. dryRun: true — Observe-only mode on any check, so you can stage Blursec into production traffic before enforcing.

​

Install

npm install @blursec/sdk

​

The 4-line login endpoint

import { Blursec } from "@blursec/sdk";

const blursec = new Blursec({ apiKey: process.env.BLURSEC_API_KEY! });

app.post("/login", async (req, res) => {
  const { email, password } = req.body;

  const risk = await blursec.checkCredential(email, password);
  if (risk.leaked) {
    return res.status(403).json({
      error: "credential_compromised",
      action: risk.recommendedAction, // "block" | "force_reset" | "monitor"
    });
  }

  // ...your normal password verification continues here
});

• Configuration — environments, timeouts, custom fetch
• Errors & fail-open — the error hierarchy and why checks fail open
• Advanced usage — k-anonymity protocol, hash helpers, wire format
• AI agents & MCP — let Claude/Copilot query the database as tools
• Mobile & frontend apps — React, React Native, Flutter integration

​

How it works (prefix-blinded lookup)

1. SDK hashes email + ":" + password with SHA-256 locally → 64-char hex digest.
2. SDK sends only the first 10 hex characters to the API — one-way, irreversible.
3. API returns every entry in that bucket; the SDK compares suffixes locally.

​

Runnable examples

​

Ecosystem packages