Tutorial · Threat API · Free
Check links before users click
Warn or block when a user posts or opens a link to a confirmed scam domain, for example in a chat, comment section or email gateway.
1Extract the domains
Collect the hostnames of all links in a message. Lookups also match the registrable parent, so login.fake-bank.example is found when fake-bank.example is listed.
2Check them in one request
Batch up to 100 domains per call. Run this on your server with a free key.
async function checkLinks(urls) {
const domains = [...new Set(urls.map((u) => new URL(u).hostname))].slice(0, 100);
if (!domains.length) return [];
const res = await fetch("https://ugapgzpffrykyglevlhz.supabase.co/functions/v1/threat-api/v1/check", {
method: "POST",
headers: { "X-API-Key": process.env.FP_KEY, "Content-Type": "application/json" },
body: JSON.stringify({ domains }),
});
if (!res.ok) return []; // fail open: never block users because a lookup failed
return (await res.json()).filter((r) => r.listed && r.status === "active");
}3Act and cache
Show a warning or hold the message for review when a result is listed and active. Cache results for up to 10 minutes: the database refreshes every ten minutes, so caching longer misses new listings and shorter wastes quota.
Need more than 1,000 lookups a day? Download the feed instead (next tutorial) or use a company key.