Signup and usage protection for SaaS and AI products

Keep your free tier for real customers.

isCredible checks every signup, login and costly action in a single API call, and tells you whether to approve, review or block it. Stop throwaway emails, second accounts and scripted signups without adding a single step for honest users.

Free plan with 100 checks a day. No credit card.

Decisionslive example
  • APPROVEtrial.startnew customer, first trial
  • DENYsignupthird look-alike email on one device
  • APPROVEsignupmaria@northwind.io
  • REVIEWtrial.startburst of signups from one network

The problem

A generous free tier attracts more than customers.

Every free plan is an offer, and some people treat it as a resource to drain. The cost shows up as compute bills, support tickets and growth numbers you can no longer trust.

Second accounts and endless trials

The same person signs up again with a new address the moment their free credits run out.

Throwaway emails

Disposable inboxes cost nothing to create, so your free tier becomes a free supply.

Scripts that sign up by the hundred

Automated signups drain compute, flood your metrics and hide the real customers.

How it works

One call before you hand out anything valuable.

Call isCredible when someone signs up, logs in, starts a trial or asks for an API key. It answers with a decision you can act on immediately.

  1. 1

    Send what you already know

    Email, IP address, a device ID and your own user ID. Add more signals whenever you like.

  2. 2

    Get a decision with reasons

    Approve, review or deny, a risk score and plain-language reasons for every check that fired.

  3. 3

    Act on it your way

    Let good users straight in, ask for a quick extra step when in doubt, and keep abusers out.

  4. Integrate in about ten minutes
import { IsCredibleClient } from "is-credible";

const iscredible = new IsCredibleClient({ apiKey: process.env.ISCREDIBLE_API_KEY! });

const result = await iscredible.verify({
  email: "jane@example.com",
  ip: req.ip,
  deviceId: body.deviceId,
  userId: user.id,
  accountCreation: true
});

if (result.overallRecommendation === "DENY") return blockSignup();
if (result.overallRecommendation === "REVIEW") return askForPhoneCheck();
return createAccount();
{
  "overallRecommendation": "DENY",
  "overallRiskScore": 100,
  "summary": "High risk. Key concerns: Disposable email address detected",
  "scenarioResults": [
    {
      "scenarioId": "SYS_DISPOSABLE_EMAIL_001",
      "recommendation": "DENY",
      "ruleReports": [
        {
          "status": "FLAGGED",
          "findings": [
            { "code": "DISPOSABLE_EMAIL_DETECTED",
              "message": "Disposable email address detected" }
          ]
        }
      ]
    }
  ]
}

What it catches

The abuse patterns that cost free tiers the most.

Twenty ready-made scenarios cover signups, trials, logins, payments and usage. Turn on what fits your product and adjust the rest.

Throwaway and invalid emails

Disposable inboxes, made-up domains and addresses that can never receive your onboarding email.

Second accounts and repeat trials

The same device, card or look-alike email coming back for another free trial.

Bots and scripted signups

Headless browsers, machine-speed form filling and signup bursts from one network.

Account takeover

Logins from a device or country an account has never used, right before a password change.

Payment and trial abuse

One card behind many accounts, subscription cycling and failed verification checks.

Credit farming and usage spikes

New accounts that burn through free credits or API quota far faster than real users do.

Built to be trusted

Decisions you can explain to your team and your users.

A reason for every decision

Each response lists the checks that fired in plain language, so support can answer “why was I blocked?” in seconds.

Your users stay yours

History is kept per account. Your users are never compared with another company's users.

Honest users don't notice

No captchas or extra screens for the people you approve. You choose what happens on review.

Fails safe

If a check cannot run, you get an answer that lets the user through, so an outage never costs you a signup.

Is that email address disposable?

Check any address with our free email checker, no account needed.

Try the email checker

Pricing

Start free. Pay when it pays for itself.

Every paid plan starts with a 14-day trial. After the trial you stay on the Free plan unless you choose to upgrade.

Free

$0

100 checks a day

For side projects and small apps getting their first users.

  • All built-in scenarios
  • Your own scenarios and rules
  • A reason with every decision
  • Dashboard and history

Startup

Popular

$19per month

500 checks a day

For products with steady signups and a free tier worth protecting.

  • Everything in Free
  • 5x the daily volume
  • Higher rate limits
  • Priority email support

Growth

$49per month

2,000 checks a day

For busy products checking signups, logins and costly actions.

  • Everything in Startup
  • 20x the free volume
  • Highest rate limits
  • Help with your first integration

Enterprise

Custom

Volume to fit

For larger volumes, custom terms or a dedicated setup.

  • Custom limits
  • Custom scenarios built with you
  • Invoice billing
  • Direct line to the team
Contact us

Questions

Good to know before you start.

Will this slow down signups for real users?
No extra step is added for the people you approve, and most of your users will be approved. You decide what happens on review, for example a phone check or fewer free credits until they verify.
What data do I need to send?
An email address is enough to start. Adding the IP address, a device ID and your own user ID makes decisions much sharper. You never send passwords or payment card numbers.
Is my users' data shared with other customers?
No. History is kept per isCredible account, so your users are only ever compared with your own users.
What if the API is unreachable?
Treat a timeout or error as approve and log it, so an outage never blocks a legitimate signup. The SDK has timeouts and retries built in.
Can I adjust what counts as suspicious?
Yes. Start with the built-in scenarios, then clone and change them, or build your own rules in the dashboard.
What happens when I reach my daily limit?
Further checks return HTTP 429 until the limit resets the next day. Upgrade at any time, or contact us for higher volumes.

Protect your next signup in the next ten minutes.

Create a free account, copy your API key, and add one call to your signup handler.

Browse the docs
APPROVE REVIEW DENYwith reasons, every time