Email risk API for signup and invite flows
When you only have an email — scoring disposable domains, role accounts, and risky patterns before you send the invite.
By AbuseGraph Team
Sometimes the only signal is an address
Invites, waitlists, and magic-link starts often happen before a full browser SDK run. An email risk endpoint lets you decide whether to send the message at all.
What “email risk” is (and is not)
It is not a guarantee the human is good. It is structured context: disposable providers, unusual patterns, and correlation with your workspace history when available.
Combine email scores with full signup checks once the user lands in the browser.
Wire it early
- Score on invite create
- Score again on signup completion with the full check
- Put known-good partner domains on an allow list
API shapes are in OpenAPI (/openapi.json) and the docs console.
Wire email scoring next to full signup checks — see the signup fraud guide and API docs.
Further reading
Next
Put a live check on signup
Free forever — 1,000 live API checks / month. Unlimited test keys. No credit card.
Related reading
- Guides
Integrate account protection with Clerk, Auth0, Better Auth, and Firebase
One pattern for every auth stack: collect in the browser, check with a secret key in your hook, enforce the verdict before createSession / createUser.
- Guides
Credential stuffing defense for login APIs
How velocity, bot-like clients, and breach-aware signals help stop stuffing without locking out real users.
- Guides
Password reset fraud — the quiet account takeover path
Why password-reset and email-change events need the same risk API as signup — and how to wire them without rewriting your auth stack.