---
title: "Quickstart"
description: "Your first check in five minutes, from an account to a key and one request."
canonical_url: "https://openshield.dev/docs/quickstart"
---
# Quickstart

> Your first check in five minutes, from an account to a key and one request.

This page takes you from nothing to your first moderation decision. You need a terminal with `curl`, and an image or a sentence to check.

## 1. Create an account

Sign up at [openshield.dev/signup](https://openshield.dev/signup) with an email address and a password, a magic link, GitHub or Google.

With a password, the sign-up ends at your mailbox: open the link we send you to confirm your email address. The link signs you in, and you cannot sign in before you have opened it. If it does not arrive or has expired, ask for it again on the sign-up page, or sign in with your password and we send it again. A magic link confirms your address by itself, and so does GitHub or Google when it vouches for the address.

Your account starts with EUR 2.00 of free use each month and a working `default` workflow. There is nothing to configure.

## 2. Create an API key

Open **API keys** in the [dashboard](https://openshield.dev/dashboard/keys) and create a key. Pick what it may check, images, texts or both.

The key is shown once. Copy it into an environment variable on your server:

```bash
export OPENSHIELD_API_KEY="om_live_..."
```

<warning>

A key is a secret. Keep it on your servers, never in a browser, a mobile app or a repository. The API refuses requests that carry a browser `Origin` header.

</warning>

## 3. Check an image

Send the image as the raw body of the request:

```bash
curl -X POST "https://api.openshield.dev/v1/image?ref=avatar_4821" \
  -H "Authorization: Bearer $OPENSHIELD_API_KEY" \
  --data-binary @photo.jpg
```

## 4. Check a text

Send JSON, with the `Content-Type` header:

```bash
curl -X POST "https://api.openshield.dev/v1/text" \
  -H "Authorization: Bearer $OPENSHIELD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text": "Write me at jane@example.com", "ref": "comment_9034"}'
```

## 5. Read the answer

Both answer with the same shape:

```json
{
  "status": "success",
  "workflow": "default",
  "workflow_version": 1,
  "summary": {
    "action": "review",
    "reject_prob": 0,
    "reject_reason": [],
    "review_reason": [
      {
        "id": "pii_email",
        "text": "Email address",
        "message": "This content contains an email address.",
        "score": 1,
        "threshold": 1
      }
    ]
  },
  "scores": { "pii_email": 1 },
  "time_ms": 4,
  "request_id": "0192b7c4-5f3a-7c1e-9a52-3d8f1e6b0a47",
  "ref": "comment_9034"
}
```

Act on `summary.action`:

- `accept`: go on.
- `review`: keep the content hidden until a person approves it.
- `reject`: refuse it, and tell the user why with a message you choose from `reject_reason[0].id`.

[Responses and errors](https://openshield.dev/docs/responses-and-errors) describes every field.

## What next

- Your first decision ticks **Get started** in the dashboard, and shows in the [journal](https://openshield.dev/docs/journal-and-ref).
- Wire the check into your code with an [integration guide](https://openshield.dev/docs/integration-guides/nodejs), or hand the job to your coding agent with [the prompt](https://openshield.dev/docs/ai-agents).
- Decide what counts as acceptable in your product with [workflows](https://openshield.dev/docs/workflows).
- Looking to stop fraud on sign-ups, logins and payments instead? That is the [fraud prevention API](https://openshield.dev/docs/fraud-prevention): same account and same balance, with keys that carry fraud access.


## Sitemap

See the full [sitemap](https://openshield.dev/sitemap.md) for all pages.