AbuseGraph + Python

Quick path

Set ABUSEGRAPH_SECRET_KEY and ABUSEGRAPH_SITE in env.
POST JSON to https://abusegraph.com/api/v1/check before creating a session.
Map verdict to deny (block) or step-up (challenge).

Keys

Key	Env	Use
Secret	`ABUSEGRAPH_SECRET_KEY` (`sk_test_…` / `sk_live_…`)	Server `/api/v1/check`
Publishable	`NEXT_PUBLIC_ABUSEGRAPH_PUBLISHABLE_KEY` (`pk_test_…`)	Browser SDK
Site	`ABUSEGRAPH_SITE`	DNS-verified domain

Free includes 1,000 live API checks / month after DNS verify. Test keys never bill.

Env

bash

ABUSEGRAPH_SITE=yourdomain.com
ABUSEGRAPH_CHECK_URL=https://abusegraph.com/api/v1/check
ABUSEGRAPH_SECRET_KEY=sk_test_…

Use sk_live_… in production after DNS verify.

Server check

Python uses direct HTTP POST to https://abusegraph.com/api/v1/check. Events: signup | login | password_reset | email_change. Optional sessionId.

python

import os
import requests

def abusegraph_check(
    *,
    email: str,
    event: str = "signup",
    user_id: str | None = None,
    session_id: str | None = None,
    **extra,
) -> dict:
    site = os.environ["ABUSEGRAPH_SITE"]
    url = os.environ.get(
        "ABUSEGRAPH_CHECK_URL",
        "https://abusegraph.com/api/v1/check",
    )
    r = requests.post(
        url,
        headers={
            "content-type": "application/json",
            "x-api-key": os.environ["ABUSEGRAPH_SECRET_KEY"],  # sk_test_…
            "x-abusegraph-site": site,
        },
        json={
            "email": email,
            "userId": user_id,
            "sessionId": session_id,
            "event": event,
            "site": site,
            **extra,
        },
        timeout=10,
    )
    if r.status_code == 402:
        raise RuntimeError("credits_exhausted")
    r.raise_for_status()
    return r.json()

FastAPI example:

python

from fastapi import HTTPException

@app.post("/register")
def register(email: str, password: str):
    result = abusegraph_check(email=email, event="signup")
    if result["verdict"] == "block":
        raise HTTPException(status_code=403, detail="signup blocked")
    # create user + session
    return {"ok": True}

Browser signals (recommended)

If you serve a web UI, forward toCheckBody fields from @palisade/sdk in the request body — NEVER use browser-only checks as the authoritative decision.

Lifecycle events

login — abusegraph_check(email=email, event="login") before session issue.
password_reset — event="password_reset" on reset request.
email_change — event="email_change" after email update.

Platform

Lists, rules, and linked accounts apply on every check — configure in the console. Optional session: POST /api/v1/session. Native apps: iOS, Android, React Native.