isCredible

Getting started

Quickstart

Make your first isCredible call and protect your signup form in about ten minutes.

This guide takes you from a new account to a protected signup handler.

1. Create an account and an API key#

Create a free account, sign in, confirm your email address, and open API key in the dashboard to create your key. Store it as an environment variable on your server:

ISCREDIBLE_API_KEY=your_api_key

Keep the key on your server

Call isCredible from your backend, never from browser or mobile code. Anyone with your key can use your quota.

2. Make your first call#

curl https://api.iscredible.com/v1/credibility/verify \
  -H "x-api-key: $ISCREDIBLE_API_KEY" \
  -H "content-type: application/json" \
  -d '{ "userData": { "email": "test@mailinator.com" } }'

A throwaway address like this one comes back as DENY, with the reason in summary and in each scenario's ruleReports.

3. Protect your signup handler#

Send everything you know at signup time. The more you send, the sharper the decision.

import { IsCredibleClient, decide } from "is-credible";

const iscredible = new IsCredibleClient({ apiKey: process.env.ISCREDIBLE_API_KEY! });

export async function signup(req, res) {
  const { email, deviceId } = req.body;

  let action = "APPROVE";
  try {
    const result = await iscredible.verify({
      email,
      ip: req.ip,
      deviceId,                         // see "Send device signals"
      userAgent: req.headers["user-agent"],
      accountCreation: true
    });
    action = decide(result).action;
  } catch (err) {
    console.warn("isCredible unavailable, allowing signup", err); // fail open
  }

  if (action === "DENY") return res.status(403).json({ error: "We couldn't create your account." });
  const user = await createUser(email, { needsVerification: action === "REVIEW" });
  return res.json({ id: user.id });
}

4. Next steps#