Guides
Protect signups
Stop throwaway emails, second accounts and automated signups at registration.
Signup is where most free-tier abuse starts. Checking it costs one API call and adds nothing to the experience of honest users.
What to send#
| Field | Why it helps |
|---|---|
email | Throwaway and invalid addresses, look-alike addresses across accounts |
ip | Proxies and VPNs, bursts of signups from one network |
deviceId | Several accounts created from the same device |
userAgent | Automated browsers |
accountCreation: true | Marks the event as a signup, which enables signup-rate checks |
paymentFingerprint | The same card behind several accounts (if you collect a card) |
Signup-behaviour signals from your form make bot detection much stronger. See Send device signals.
Example#
const result = await iscredible.verify({
email: body.email,
ip: req.ip,
deviceId: body.deviceId,
userAgent: req.headers["user-agent"],
accountCreation: true
});Acting on the result#
- APPROVE: create the account as usual.
- REVIEW: create the account but hold back the valuable part, for example require email or phone verification before free credits are granted.
- DENY: show a neutral message such as "We couldn't create your account" and offer a support contact. Don't reveal which check fired.
Check before you send the welcome email
Run the check before creating the user record and sending emails, so blocked signups never reach your mailing list or analytics.