Next.js bot detection and email validation

npm install zod

import { NextResponse } from "next/server";
import { z } from "zod";

export const runtime = "edge";

const Body = z.object({ email: z.string().email().max(254) });
const NEUTRAL = { is_risky: false, risk_score: 0, reasons: [] };

export async function POST(request: Request) {
  const parsed = Body.safeParse(await request.json().catch(() => null));
  if (!parsed.success) {
    return NextResponse.json({ error: "Invalid email" }, { status: 400 });
  }

  const key = process.env.TURING_API_KEY;
  // A misconfiguration must not look like a risk verdict.
  if (!key) return NextResponse.json(NEUTRAL);

  try {
    const response = await fetch("https://uat.turing-api.com/v1/email-check", {
      method: "POST",
      headers: { Authorization: "Bearer " + key, "Content-Type": "application/json" },
      body: JSON.stringify({ email: parsed.data.email }),
      signal: AbortSignal.timeout(3000),
    });
    if (!response.ok) throw new Error("turing " + response.status);
    return NextResponse.json(await response.json());
  } catch {
    return NextResponse.json(NEUTRAL);
  }
}

// middleware.ts - block datacenter IPs before rendering
import { NextResponse, type NextRequest } from "next/server";

export const config = { matcher: ["/signup", "/api/checkout"] };

export async function middleware(request: NextRequest) {
  const ip = request.headers.get("cf-connecting-ip") ?? request.headers.get("x-real-ip");
  if (!ip || !process.env.TURING_API_KEY) return NextResponse.next();

  try {
    const response = await fetch("https://uat.turing-api.com/v1/bot-check", {
      method: "POST",
      headers: {
        Authorization: "Bearer " + process.env.TURING_API_KEY,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ ip, user_agent: request.headers.get("user-agent") ?? "" }),
      signal: AbortSignal.timeout(2000),
    });
    const verdict = await response.json();
    if (verdict.is_bot) return new NextResponse("Forbidden", { status: 403 });
  } catch {
    // fail open
  }
  return NextResponse.next();
}

curl -X POST https://uat.turing-api.com/v1/bot-check \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip":"52.1.2.3","user_agent":"curl/8.4.0"}'

import requests

HEADERS = {"Authorization": "Bearer YOUR_API_KEY"}

response = requests.post(
    "https://uat.turing-api.com/v1/bot-check",
    headers=HEADERS,
    json={"ip": "52.1.2.3", "user_agent": "curl/8.4.0"},
    timeout=5,
)
response.raise_for_status()
print(response.json())

const response = await fetch("https://uat.turing-api.com/v1/bot-check", {
  method: "POST",
  headers: {
    Authorization: "Bearer YOUR_API_KEY",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"ip":"52.1.2.3","user_agent":"curl/8.4.0"}),
  signal: AbortSignal.timeout(5000),
});

if (!response.ok) throw new Error("turing: " + response.status);
console.log(await response.json());

$curl = curl_init("https://uat.turing-api.com/v1/bot-check");
curl_setopt_array($curl, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 5,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => '{"ip":"52.1.2.3","user_agent":"curl/8.4.0"}',
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer YOUR_API_KEY",
        "Content-Type: application/json",
    ],
]);

$body = curl_exec($curl);
$status = curl_getinfo($curl, CURLINFO_RESPONSE_CODE);
curl_close($curl);

$verdict = $status === 200 ? json_decode($body, true) : null;
var_dump($verdict);

require "net/http"
require "json"

uri = URI("https://uat.turing-api.com/v1/bot-check")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer YOUR_API_KEY"
request["Content-Type"] = "application/json"
request.body = { ip: "52.1.2.3", user_agent: "curl/8.4.0" }.to_json

response = Net::HTTP.start(uri.hostname, uri.port,
                           use_ssl: uri.scheme == "https",
                           open_timeout: 5, read_timeout: 5) do |http|
  http.request(request)
end

puts JSON.parse(response.body)