Run a reverse proxy on your own infrastructure

[device] ──evidence──► [your server] ──► [your proxy] ──► [api.rootherald.io]
 dumb collector         (you run)          (you run)         (we run)
 no keys, no RH         createChallenge    /api/v1/*         verifier + DB
 contact                + attest()         forwarded up      returns verdict

import express from "express";
import { createProxyMiddleware } from "http-proxy-middleware";

const app = express();

app.use(
  // /api/v1 covers challenge + verify; add jwks only if you opt into returnToken.
  ["/api/v1", "/.well-known/jwks.json"],
  createProxyMiddleware({
    target: "https://api.rootherald.io",
    changeOrigin: true,
  }),
);

app.listen(443);

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddReverseProxy()
    .LoadFromMemory(
        new[]
        {
            new RouteConfig
            {
                RouteId = "rh",
                ClusterId = "rh-upstream",
                Match = new RouteMatch { Path = "/api/v1/{**catch-all}" },
            },
        },
        new[]
        {
            new ClusterConfig
            {
                ClusterId = "rh-upstream",
                Destinations = new Dictionary<string, DestinationConfig>
                {
                    ["root"] = new() { Address = "https://api.rootherald.io" },
                },
            },
        });

var app = builder.Build();
app.MapReverseProxy(opt =>
{
    opt.Use(async (ctx, next) =>
    {
        ctx.Request.Headers["X-Root-Herald-Forwarded-For"]
            = ctx.Connection.RemoteIpAddress?.ToString();
        await next();
    });
});

export default {
  async fetch(req: Request): Promise<Response> {
    const url = new URL(req.url);
    if (!url.pathname.startsWith("/api/v1") &&
        url.pathname !== "/.well-known/jwks.json") {
      return new Response("Not found", { status: 404 });
    }
    const upstream = new URL(url.pathname + url.search, "https://api.rootherald.io");
    const headers = new Headers(req.headers);
    return fetch(upstream, {
      method: req.method,
      headers,
      body: req.body,
    });
  },
};