# tRPC

If you are using tRPC with a web framework like Express or Fastify, please check the matching framework's documentation too.

At the very beginning of your app.js file, add the following line:

```js
require("@aikidosec/firewall"); // <-- Include this before any other code or imports

import { initTRPC } from "@trpc/server";

const t = initTRPC.create();

// ...
```

or using `import` syntax:

```js
import "@aikidosec/firewall";

// ...
```

> [!NOTE]
> Many TypeScript projects use `import` syntax but still compile to CommonJS — in that case, the setup above works as-is. If your app runs as **native ESM** at runtime (e.g. `"type": "module"` in package.json), see [ESM setup](./esm.md) for additional steps.

## Blocking mode

By default, the firewall will run in non-blocking mode. When it detects an attack, the attack will be reported to Aikido if the environment variable `AIKIDO_TOKEN` is set and continue executing the call.

You can enable blocking mode by setting the environment variable `AIKIDO_BLOCK` to `true`:

```sh
AIKIDO_BLOCK=true node app.js
```

It's recommended to enable this on your staging environment for a considerable amount of time before enabling it on your production environment (e.g. one week).

## Rate limiting and user blocking

If you are using a web framework like Express, Fastify, or similar, please check the matching framework's documentation for how to enable this feature.
If you are using tRPC's Standalone Adapter, you can add the rate limiting feature to your app by modifying your code like this:

```ts
// Call this directly after your authentication, as early as possible in your resolver/middleware chain
const result = shouldBlockRequest();

if (result.block) {
  if (result.type === "ratelimited") {
    let message = "You are rate limited by Zen.";
    if (result.trigger === "ip" && result.ip) {
      message += ` (Your IP: ${result.ip})`;
    }

    // Throw an error or write a response to the client, depending on your setup
  }

  if (result.type === "blocked") {
    // Throw an error or write a response to the client, depending on your setup
  }
}
```

## Debug mode

If you need to debug the firewall, you can run your tRPC app with the environment variable `AIKIDO_DEBUG` set to `true`:

```sh
AIKIDO_DEBUG=true node app.js
```

This will output debug information to the console (e.g. if the agent failed to start, no token was found, unsupported packages, ...).

## Preventing prototype pollution

Zen can also protect your application against prototype pollution attacks.

Read [Protect against prototype pollution](./prototype-pollution.md) to learn how to set it up.

That's it! Your app is now protected by Zen.  
If you want to see a full example, check our [tRPC sample app](../sample-apps/trpc-server).

## Graceful shutdown

It is recommended to add a shutdown handler to your app to ensure that no statistics are lost when the app is stopped. You can find more information [here](./graceful-shutdown.md).