Signup fraud prevention API — what to score before the account exists
How to score signup risk with email, device, IP, and velocity signals before you create the user — and what a clean check response should look like.
By AbuseGraph Team
The problem starts before the row exists
Most account abuse starts at registration: disposable emails, recycled devices, scripted signups, and credential-stuffing that looks like “new users.” If you only look after the account is created, you’re already cleaning up.
AbuseGraph’s job at signup is simple: return a score, verdict, and reasons so your app can allow, step-up, or block — before you write the user.
What to send on signup
Minimum useful payload:
event:signupemail(normalized on your side if you can)- browser SDK collect payload (or server-only fields if you have no client)
- optional:
userIdonce you have a provisional id,ip,userAgent
You keep enforcement. We return something like Looks good / Verify first / Watch closely / Block with explainable reasons.
Why “device ID only” is not enough
A sticky visitor ID answers “have we seen this browser?” Signup fraud asks “should we create this account?” Those are different jobs. Pair identity hints with email intel, network context, velocity, and your own lists/rules.
A clean integration pattern
- Browser SDK collects signals → preliminary evaluate (publishable key)
- Your auth backend calls
/api/v1/checkwith a secret key (sk_) - You enforce the verdict in your signup handler
- Optionally bind a session later with the session API
Auth provider guides — Clerk, Auth0, Better Auth, Firebase, and more — all follow that same shape. Browse the full integrations list.
Free path that is actually live
AbuseGraph Free includes 1,000 live API checks / month plus unlimited test keys. That is enough to ship signup protection on a real domain without a sales call. Start free, or read what “free” means for a live API.
Further reading
Next
Put a live check on signup
Free forever — 1,000 live API checks / month. Unlimited test keys. No credit card.
Related reading
- Guides
Integrate account protection with Clerk, Auth0, Better Auth, and Firebase
One pattern for every auth stack: collect in the browser, check with a secret key in your hook, enforce the verdict before createSession / createUser.
- Guides
Email risk API for signup and invite flows
When you only have an email — scoring disposable domains, role accounts, and risky patterns before you send the invite.
- Guides
Credential stuffing defense for login APIs
How velocity, bot-like clients, and breach-aware signals help stop stuffing without locking out real users.