MeID - Anti-Sybil Suite

Anti-Sybil SDK - A rapid and privacy-preserving solution to combat bot and sybil attacks by using the RedirectURL as the src-attribute value for the iFrame.

Use Case

When you need to protect a website or application from automated attacks, you can use anti-bot mechanisms. These attacks can result in malicious behavior, such as spamming, data theft, or network disruption. Anti-bot technology is designed to identify and block these attacks to ensure that only real human users can access your website or application.

In this case, users are required to undergo facial liveliness detection to prove that they are real human users. This detection requires users to perform specific actions or expressions in front of a camera to prove that they are genuine humans and not automated programs. This technology can help prevent automated attacks and fraud, and increase the security and reliability of your website or application.

---

zkMe-Widget MeID Process

Step 1: Enter the service authorization Widget page; the user confirms and goes to the next step

Step 2: E-mail verification login / Wallet address login

Step 3: Verify that the user has authorized MeID

Step 4: Based on the outcomes of the initiated query, a determination is made regarding whether to commence the authentication process for the specified user.

---

Interaction Instructions

---

Integration via NPM

You can refer to @zkmelabs/widget and please make sure to use the latest version.

Installation

pnpm add @zkmelabs/widget

# or
yarn add @zkmelabs/widget

# or
npm install @zkmelabs/widget

Getting Started

Step 1. Import styles

import '@zkmelabs/widget/dist/style.css'

Step 2. Create a new ZkMeWidget instance

Email Login Mode

import { ZkMeWidget, type Provider } from '@zkmelabs/widget'

const provider: Provider = {
  async getAccessToken() {
    // -------------------------TODO-------------------------
    // Request a new token from your backend service and return it to the widget.
    // For the access token, see docs.zk.me/zkme-dochub/verify-with-zkme-protocol/integration-guide/javascript-sdk/meid-anti-sybil-suite#how-to-generate-an-access-token-with-api_key
    // ------------------------------------------------------
    return fetchNewToken()
  },

  async getUserAccounts() {
    // -------------------------TODO-------------------------
    // If your project is a Dapp,
    // you need to return the user's connected wallet address.
    const userConnectedAddress = await connect()
    return [userConnectedAddress]

    // If not,
    // you should return the user's e-mail address, phone number or any other unique identifier.
    //
    // return ['email address']
    // or
    // return ['phone number']
    // or
    // return ['unique identifier']
    // ------------------------------------------------------
  },

}

const zkMeWidget = new ZkMeWidget(
  // -------------------------TODO-------------------------
  appId, // This parameter means the same thing as "mchNo"
  'YourDappName',
  chainId,
  provider,
  {
      lv: 'MeID'
      // For other options, please refer to the table below
  }
  // ------------------------------------------------------
)

Wallet Login Mode

import { ZkMeWidget, type Provider } from '@zkmelabs/widget'

const provider: Provider = {
  async getAccessToken() {
    // -------------------------TODO-------------------------
    // Request a new token from your backend service and return it to the widget.
    // For the access token, see docs.zk.me/zkme-dochub/meid-anti-bot-suite/meid-integration-guide/sdk-integration#how-to-generate-an-access-token-with-api_key
    // ------------------------------------------------------
    return fetchNewToken()
  },

  async getUserAccounts() {
    // If your project is a Dapp,
    // you need to return the user's connected wallet address.
    const userConnectedAddress = await connect()
    return [userConnectedAddress]
  },

}

const zkMeWidget = new ZkMeWidget(
  // -------------------------TODO-------------------------
  appId, // This parameter means the same thing as "mchNo"
  'YourDappName',
  chainId,
  provider,
  {
      lv: 'MeID',
      mode: 'wallet',
      // Whether to verify the validity of the user's wallet. Default is false. 
      // If set to true, you need to implement the provider.signMessage method.
      checkAddress: true 
      // For other options, please refer to the table below
  }
  // ------------------------------------------------------
)

NOTE: The specific configuration for the "option" parameter is shown in the table below

Param	Type	Description
options.theme	Theme?	"auto", "light" or "dark", default "auto".
options.locale	Language?	"en" or "zh-hk", default "en".

Step 3. Listen to the meidFinished widget event to detect when the user has completed the MeID process

function handleFinished(results) {
  const { isGrant, associatedAccount } = results

  if (
    isGrant &&
    associatedAccount === userConnectedAddress.toLowerCase()
  ) {
    // Prompts the user that MeID verification has been completed
  }
}

zkMeWidget.on('meidFinished', handleFinished)

Step 4. Launch the zkMe widget and it will be displayed in the center of your webpage

// This is the code to launch our widget on your page
button.addEventListener('click', () => {
  zkMeWidget.launch()
})

---

Helper functions

verifyMeidWithZkMeServices()

Before launching the widget, you should check the MeID status of the user and launch the widget when the check result is false.

import { verifyMeidWithZkMeServices } from '@zkmelabs/widget'

// MeID
const { isGrant } = await verifyMeidWithZkMeServices(
  appId,
  userAccount
)

Param	Type	Description
appId	string	This parameter means the same thing as "mchNo"
userAccount	string	The userAccount info (such as wallet address, email, phone number, or unique identifier) must match the format of accounts returned by provider.getUserAccounts.

How to Generate an Access Token with API_KEY

To use your API_KEY to obtain an accessToken, you will need to make a specific HTTP request. Here's how you can do it:

a. Endpoint: Send a POST request to the token exchange endpoint.

POST https://nest-api.zk.me/api/token/get

Please remember to modify the Content-Type in the request header to application/json. Failing to do so might result in a Parameter Error response.

b. Request Body:

Parameter Name	Required	Type	Desc
apiKey	True	string	The API_KEY provided by zkMe.
appId	True	string	A unique identifier (mchNo) to DApp provided by zkMe.
apiModePermission	True	number	0 - email login 1 - wallet address login
lv	True	number	The parameter must be passed and always be 2.

API_KEYcan be found in the Configuration section of the Integration on the zkMe Dashboard.

c. Response

Success

{
    "code": 80000000,
    "data": {
        "accessToken": "8641259808779c53de65c3698e42b402b112cfe3856202189c37eae9f0b23babbcc1429ea9adcb52283dca4dab024a640651f855d8c78c7bde308f721a6e0cb80d51dab7c775ebfe0ae74eb9ab02f503094a9b2a2e2aeabf70e03a0cac9773a93dba743ca0dc3fa4af77375351bc48f76515d72dbee3a8bd5c034e6ffb94bd97"
    },
    "msg": "success",
    "timestamp": 1691732474552
}

Exception (AppId and API_KEY not matched)

{
    "code": 81000014,
    "data": null,
    "msg": "AppID and API Key do not match. Access token generation failed",
    "timestamp": 1691732568774
}

Exception (Parameter Error)

{
    "code": 80000002,
    "data": null,
    "msg": "parameter error",
    "timestamp": 1691732593484
}

Exception (System Error)

{
    "code": 80000001,
    "data": null,
    "msg": "system error",
    "timestamp": 1691732593484
}

---

ZkMeWidget instance methods

launch()

Launch the zkMe widget and it will be displayed in the center of your webpage.

launch(): void

on()

Listen to zkMe widget events.

on(event: 'meidFinished', callback: MeidFinishedHook): void;
on(event: 'close', callback: () => void): void;

hide()

Hide the zkMe widget.

hide(): void

destroy()

Remove the message event listener registered by the zkMe widget from the window and destroy the DOM node.

destroy(): void

---

Response & Exceptions

Success

If the user has passed the liveness and uniqueness verification, the following interface will be seen.

Note:

The finished callback function will be fired after the interface is displayed.

Camera Permission Denied Error

The following screen will be displayed for possible issues such as the user denying browser camera access or not having a camera on the device.

Face Recognition Error

The following screen will be displayed for possible problems such as eyes closed detected, art mask detected and etc.

Existing Faceprint Error

The following screen will be displayed for the possible problem that the user’s faceprint is similar to another user’s.

Faceprint Recognition Server Error

The following screen will be displayed when something goes wrong on the faceprint recognition server.

Unknown Error

The following screen will be displayed when something goes wrong not listed above.