Quick start

Integration process

Prerequisites

Get an account

Composer comes with every Spreedly organization — there's no separate account to sign up for. If you're new to Spreedly, create an account, then set up an environment and access secret to start building checkpoints. If you're already a Spreedly customer, you can start building checkpoints in your existing organization by navigating to Composer at app.spreedly.com.

Find your API keys

Once logged into the Composer Dashboard, find your keys under API Configuration in the Developer Center.

Decide where to add checkpoints

Identify the points in the user journey where you want Composer to make a decision — whether that's screening for fraud, running the payment itself, or both together in one flow. Common examples:

• Account Creation — screen for fake accounts
• Login — screen for stolen credentials
• Payment — screen for chargeback abuse and stolen cards, and/or run the transaction itself: authorize, capture, route to a gateway, retry a soft decline
• Listing Creation — screen for fake listings
• Checkout — run authorization, capture, and gateway routing, with fraud and 3DS checks in the same flow if you need them

Understanding the user journey

As a customer uses your application, Composer builds a profile of their behavior from data gathered via SDKs and server-side code. For example, a user going through four checkpoints might provide:

• SIGN_UP — customer.location, customer.firstName, customer.lastName, customer.primaryEmail, customer.primaryPhone
• VERIFY — customer.isVerified, customer.location (2nd reading)
• LOGIN — customer.location (3rd reading)
• PAYMENT — customer.location (4th reading), transaction.amount, transaction.currency, billing.zip

By the time the user reaches the PAYMENT checkpoint, Composer has a rich dataset to perform advanced analysis — for example, checking whether the user has ever been near the billing zip code to help identify potentially fraudulent activity. The PAYMENT checkpoint can also be where the transaction itself runs — authorization, capture, and gateway routing — with that same fraud and identity data available to inform the decision in the same flow.

Configure Client Side SDK (optional)

The Client SDK tracks user behavior and sends it to Composer to build a behavioral profile. It also enables real-time responses to checkpoint verifications, allowing you to prompt users for MFA, IDV, a 3DS challenge, and more.

This example is simplified. See the Client SDKs page for full usage.

import { Composer } from "@dodgeball/trust-sdk-client" // package name unconfirmed — see flag above
const composer = new Composer(composerPublicApiKey)

// Start Tracking
composer.track(currentSessionId, currentUserId);

// Call a Checkpoint
const endpointResponse = await fetch("https://my-server/composer-checkpoint", fetchConfig);
const responseData = await endpointResponse.json();
composer.handleVerification(responseData?.verification, {
  ... // Handle the verification...
});

Information gathered automatically:

• Device Fingerprints
• Page Views
• Integration Scripts (if enabled)
• MFA / IDV Interactions (if configured in checkpoints)

Configure Server Side SDK (required)

The Server SDK securely calls checkpoints and handles responses. It is the primary interface for interacting with Composer.

This example is simplified. See the Server SDKs page for full usage.

import { Composer } from '@spreedly/composer-sdk-server'
const composer = new Composer(process.env.SPREEDLY_SECRET_KEY)
const checkpointPayload = {
  checkpointName: "MY_CHECKPOINT_NAME",
  event: {
    ip: "some-ip-address",
    data: {
      // Add your data here
    }
  }
}
// Call a checkpoint
const checkpointResponse = await composer.checkpoint(checkpointPayload);
// Handle Checkpoint Response...

Information you can send:

• Customer Data (emails, phones, etc.)
• Transaction Data (amounts, items, etc.)
• Address Data (billing, shipping, etc.)
• Historical Data (account age, lifetime value, ratings, etc.)
• Custom Data (anything else relevant)

Create checkpoints

Create empty checkpoints for each point in the user journey where Composer should make a decision or run a transaction. Reference them by name from your application code. Business teams can customize checkpoint policies in the Composer Dashboard without touching code.

Run checkpoints via SDKs

Call checkpoints from your application code, passing the required data. Composer returns a verification that tells the application how to proceed. If any checkpoints require MFA, IDV, a 3DS challenge, or other client-side interactions, you'll need the Client SDK integrated in your frontend.

Test that it's working

1. Trigger a checkpoint in your application, then check Developer Center > Checkpoint Logs to confirm the call was received.
2. Make a change to your checkpoint, publish it, then call it again — you should see a new log entry with the updated version.

That's it! You've successfully integrated Composer into your application.