Product
How it works
Four steps from empty account to protected signups — SDK for behavioral scoring, lists and rules for policy, then ongoing watch for users who already got in.
Create your account
Sign up with email and password. No credit card. Add and verify your production domain next.
- 1,000 live checks / month included
- Test keys for localhost — never billed
- Full console after setup
Verify your domain
Add your production site and prove ownership with a DNS text record. Live keys unlock only after that.
- One domain to start — add more later
- Staging and localhost use test keys
- Live traffic stays tied to your sites
Install the SDK (web or mobile)
Web: drop in the browser SDK for mouse, typing, and device probes. Mobile: use the iOS, Android, or React Native session→check clients. Finish with a server check — API-only works, scoring is stronger with collect.
- Browser SDK or native session→check
- Optional sessionId bind for signup/login
- You keep enforcement in your app
Tune policy — then watch who got in
Add allow/block lists and no-code rules in the console. Turn on exposure monitoring: verify your company domain to protect employees, and add the host where users log in (e.g. app.acme.com) to protect customers on your platform. Daily checks, and alerts say where — never the password.
- Lists + rules evaluate on every check
- Linked-account graph for multi-accounting
- Alerts on new exposure — not old history
Browser SDK
Why the SDK matters
Modern account-protection tools run a small agent in the browser, then decide on the server. AbuseGraph works the same way. You can call the REST endpoint alone — email, IP, and graph still score — but without the SDK you miss mouse movement, typing rhythm, and the rest of the behavioral layer. That check is simply less impactful.
Browser SDK
Recommended- Full behavioral monitoring while the page is open
- Device probes + automation checks before submit
- Richer verdict — closer to what fraud agents ship
API only
Works, thinner- Email, IP, breach, and graph still score
- No mouse, typing, or in-page behavior
- Fine for server-only flows — less impactful at signup
Behavioral scoring in the browser
Mouse and pointer paths, typing rhythm, clicks, and synthetic events — signals a bare API call never sees.
Collect early, decide at signup
Init on page load so monitoring runs while the form is open. Call check() at signup or login — not on every click.
Publishable keys only
pk_live_ / pk_test_ stay in the browser. Secret sk_ keys never leave your server.
Works out of the box
Production API endpoints are the default. Retries and fail-open keep signup working if the network blips.
What the SDK monitors
Behavior
- ▸ Mouse & pointer movement
- ▸ Typing timing
- ▸ Click-without-mouse
- ▸ Synthetic / replayed events
Device
- ▸ Canvas & WebGL
- ▸ Headless / automation
- ▸ Client hints
- ▸ Private-mode checks
Session + edge
- ▸ TLS consistency
- ▸ Network & bot score
- ▸ Cookies & channel
- ▸ Fingerprint confidence
Try it on yourself first — run the live demo and move the mouse before the check scores.
Install in minutes
Load early, call at the sensitive action, finish the decision on your server. Publishable keys (pk_…) in the browser · secret keys (sk_…) on the server.
Step 1 — Install
AbuseGraph SDK
npm install @abusegraph/sdkInit early on app load. Call check({ email }) at signup or login — not on every page view.
Step 2 — Env
# Browser — publishable key only
NEXT_PUBLIC_ABUSEGRAPH_PUBLISHABLE_KEY=pk_test_…
# Optional: NEXT_PUBLIC_ABUSEGRAPH_EDGE_URL=https://api.abusegraph.com
# Server — secret key (never ship in a browser bundle)
ABUSEGRAPH_SECRET_KEY=sk_test_…
ABUSEGRAPH_SITE=yourdomain.com
ABUSEGRAPH_CHECK_URL=https://abusegraph.com/api/v1/check
# Live checks: send header x-abusegraph-site: $ABUSEGRAPH_SITEStep 3 — Browser
import { init } from "@abusegraph/sdk";
// 1. Init once on app load (starts behavioral + device collection)
const sdk = init({
publicKey: process.env.NEXT_PUBLIC_ABUSEGRAPH_PUBLISHABLE_KEY!,
// edgeUrl defaults to https://api.abusegraph.com
});
// 2. Call at signup / login — not on every page view
export async function protectSignup(email: string) {
const collected = await sdk.collect();
const edge = await sdk.evaluate(collected, { email });
// Forward full signals to your server:
// POST /api/v1/check with sk_ + sdk.toCheckBody(collected, {
// email, event: "signup", verdictToken: edge.verdictToken.token
// })
return { collected, edge };
}Step 4 — Server check
curl -X POST https://abusegraph.com/api/v1/check \
-H "x-api-key: $ABUSEGRAPH_SECRET_KEY" \
-H "x-abusegraph-site: acme.com" \
-H "content-type: application/json" \
-d '{
"email": "user@example.com",
"event": "signup",
"site": "acme.com"
}'Browser evaluate is preliminary. Your backend check with sk_… is authoritative. API docs → · Guides →