Express

// burnguard.js
export async function checkSignup({ email, ip, deviceToken, userAgent }) {
  try {
    const res = await fetch(`${process.env.BURNGUARD_URL}/v1/check`, {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.BURNGUARD_SECRET_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ event: "signup", email, ip, device_token: deviceToken, user_agent: userAgent }),
      signal: AbortSignal.timeout(1500),
    });
    return res.ok ? await res.json() : { decision: "allow" };
  } catch {
    return { decision: "allow" };
  }
}

// app.js
import express from "express";
import { checkSignup } from "./burnguard.js";

const app = express();
app.set("trust proxy", "loopback"); // so req.ip is the user's IP behind nginx
app.use(express.urlencoded({ extended: false }));

app.post("/signup", async (req, res) => {
  const check = await checkSignup({
    email: req.body.email,
    ip: req.ip,
    deviceToken: req.body.bg_device, // added by the snippet on form[data-burnguard]
    userAgent: req.get("user-agent"),
  });

  if (check.decision === "block") return res.status(403).send("We couldn't create this account.");

  const fraction = check.decision === "review" ? 0 : check.recommended_credit_fraction ?? 1;
  const user = await users.create({ email: req.body.email, password: req.body.password, credits: Math.floor(500 * fraction) });
  res.redirect("/welcome");
});

Set trust proxy to match your setup. If you run directly on the internet without a proxy, leave it off.