Skip to content
Hardn

Help centre · Walkthrough

Add runtime protection to your app

Here's how to install Hardn's runtime SDK in your app, and see what it catches. (1:14)

All help topics

Step by step

The same steps as the video.

  1. 1

    Install the SDK

    Install the SDK from npm. For Python apps, it's on PyPI as hardn-runtime.

    Install
    npm install @hardn/runtime   # Node 18+pip install hardn-runtime    # Python 3.9+
  2. 2

    Create an API key

    In Hardn, create an API key for your app, and keep it in an environment variable.

    Create a key under Configure → API keys and set it as HARDN_API_KEY wherever your app runs.

  3. 3

    Add the middleware

    Add a few lines to your app. This Express example labels AI agents, serves decoy paths, and screens chat messages for prompt injection. Flask works the same way.

    Express
    const { scoreAgent, Honeytokens, scanPrompt, Telemetry } = require("@hardn/runtime");const tel = new Telemetry(process.env.HARDN_API_KEY, { source: "storefront" });app.use((req, res, next) => {  const sig = scoreAgent({ userAgent: req.get("user-agent"), path: req.path, accept: req.get("accept") });  if (sig.isAgent) tel.record("agent_detected", { ip: req.ip, path: req.path, score: sig.score });  if (Honeytokens.isDecoyPath(req.path)) {    tel.record("honeytoken_hit", { ip: req.ip, path: req.path, score: 100 });    return res.status(404).send("Not found");  }  next();});app.post("/chat", (req, res) => {  const r = scanPrompt(req.body.message || "");  if (r.flagged) {    tel.record("injection_blocked", { path: req.path, score: r.score, detail: { tactics: r.tactics } });    return res.status(400).json({ error: "That message was refused." });  }  // … your chat handler});
    Flask
    import osfrom flask import Flask, request, abortfrom hardn_runtime import Telemetry, Honeytokens, score_agent, scan_prompttel = Telemetry(api_key=os.environ["HARDN_API_KEY"], source="storefront")honey = Honeytokens()@app.before_requestdef guard():    sig = score_agent(user_agent=request.headers.get("User-Agent"), path=request.path,                      accept=request.headers.get("Accept"))    if sig.is_agent:        tel.record("agent_detected", ip=request.remote_addr, path=request.path, score=sig.score)    if honey.is_decoy_path(request.path):        tel.record("honeytoken_hit", ip=request.remote_addr, path=request.path, score=100)        abort(404)
  4. 4

    Send it some traffic

    Start your app, then send it an AI agent, a request for a decoy path, and a prompt-injection message.

    Signals are batched (20 at a time by default); call tel.flush() when your app shuts down so the last ones are sent.

  5. 5

    Watch the Runtime page

    Back in Hardn, each signal appears on the Runtime page, with what triggered it and when.

If something goes wrong

Nothing shows on the Runtime page.
Check HARDN_API_KEY is set where the app runs and that it can reach https://api.hardn.si. Signals are sent in batches, so a quiet app can take a while to report; flushEvery: 1 sends each one at once.
Does it block traffic?
No. The SDK labels and reports; your code decides what to do (the example returns 404 for decoy paths and refuses flagged chat messages).
What does it send?
Only the signal, its path and score, and a hashed client IP. It never sends request bodies, and it's fail-open: if Hardn can't be reached, your app carries on.

More walkthroughs

Still stuck? Email support@hardn.si and a person will reply.