Control surface
Score signup and login risk. You keep enforcement. Free includes 1,000 live checks per month after DNS verify.
AbuseGraph is an account-protection API. You send a check at signup, login, password reset, or email change. You get a score, a verdict, and reasons. Your app decides what to do.
This is the operator manual — dense on purpose.
Two calls
- Browser (optional, recommended) — publishable key
pk_…→ SDKcollect/evaluateonhttps://api.abusegraph.com. - Server (required to decide) — secret key
sk_…→POST /api/v1/checkonhttps://abusegraph.com.
Never put sk_ in a client bundle. Live secrets also send x-abusegraph-site with a licensed hostname.
Start here
- Quickstart — curl a check with
sk_test_… - Keys — test vs live, site header, Free quota
- Risk Check — interactive OpenAPI for
POST /api/v1/check - Browser SDK —
collect→evaluate→toCheckBody - Guides — Clerk, Better Auth, Next.js, mobile, …
Spec
The pages under API are generated from the same document as /openapi.json. If the JSON and the docs disagree, treat the JSON as the contract.
Agents
Paste the integration prompt into Cursor / Claude / Copilot. Machine index: /llms.txt.