ScamShield API & SDK

Integrate real-time scam, phishing and fraud detection into your app. One account, up to 5 devices, 7-day free trial.

1. Getting an entitlement token

Your account and subscription live on epeace.in. After the 7-day trial is authorised, the storefront signs and provisions your account, and your app receives a signed entitlement token bound to your subscriber id and plan.

Attach that token to every /scan request. Tokens are HMAC-signed and expiry-checked; a cancelled subscription is refused server-side.

Authorization: Bearer eyJzdWIiOiJ5b3VAZXhhbXBsZS5jb20iLCJwbGFuIjoicHJvIiw... 

2. Scan for scams

curl -X POST https://scamshield.epeace.in/scan \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"text": "URGENT: your KYC will be blocked, click http://bit.ly/x to verify OTP"}'

{
  "verdict": "MALICIOUS",
  "risk": 95,
  "confidence": 92,
  "reasons": ["Credential-phishing language", "Shortened URL"],
  "sources": ["webrisk"],
  "disclaimer": "Informational only; no automated check is a guarantee."
}

3. Check entitlement

curl https://scamshield.epeace.in/billing/entitlement \
  -H "Authorization: Bearer $TOKEN"

{ "active": true, "plan": "pro", "expires_at": 1760000000, "daily_limit": 1000 }

4. Plans

5. Server-to-server provisioning

These endpoints are for the storefront only (never a client). They are authenticated with a shared secret using a signed request body.

signature = hex(HMAC_SHA256(secret, `${timestamp}.${rawBody}`))

X-ScamShield-Timestamp: 1760000000
X-ScamShield-Signature: 9f2c...e1

{"subscriber_id":"you@example.com","plan_id":"pro","billing":"monthly",
 "status":"trialing","trial_days":7,"max_devices":5,"expires_at":1760000000}

6. Errors

7. Client samples

Python

import requests

BASE = "https://scamshield.epeace.in"
TOKEN = "<entitlement_token>"

r = requests.post(
    f"{BASE}/scan",
    headers={"Authorization": f"Bearer {TOKEN}"},
    json={"text": "You won a prize, claim now at http://tiny.xyz"},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js / TypeScript

const BASE = "https://scamshield.epeace.in";
const TOKEN = process.env.SCAMSHIELD_TOKEN;

const res = await fetch(`${BASE}/scan`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Bearer ${TOKEN}`,
  },
  body: JSON.stringify({ text: message }),
});
const verdict = await res.json();
console.log(verdict.verdict, verdict.risk);

Android (Kotlin, OkHttp)

val body = """{"text": message}""".toRequestBody("application/json".toMediaType())
val req = Request.Builder()
    .url("https://scamshield.epeace.in/scan")
    .addHeader("Authorization", "Bearer $token")
    .post(body)
    .build()
client.newCall(req).execute().use { println(it.body?.string()) }