Product
How it works
Four steps from empty account to protected signups — SDK for behavioral scoring, lists and rules for policy, then ongoing watch for users who already got in.
Create your account
Sign up with email and password. No credit card. Add and verify your production domain next.
- 1,000 live checks / month included
- Test keys for localhost — never billed
- Full console after setup
Verify your domain
Add your production site and prove ownership with a DNS text record. Live keys unlock only after that.
- One domain to start — add more later
- Staging and localhost use test keys
- Live traffic stays tied to your sites
Connect your web or mobile app
Web: load the browser SDK from our CDN for mouse, typing, and device probes. Mobile: call your backend over HTTPS so it creates a session and checks the account. Your server enforces the decision before granting access.
- Browser CDN or mobile HTTPS integration
- Optional sessionId bind for signup/login
- You enforce account decisions on your server
Tune policy — then watch who got in
Add allow/block lists and no-code rules in the console. Turn on exposure monitoring: verify your company domain to protect employees, and add the host where users log in (e.g. app.acme.com) to protect customers on your platform. Daily checks, and alerts say where — never the password.
- Lists + rules evaluate on every check
- Linked-account graph for multi-accounting
- Alerts on new exposure — not old history
Browser SDK
Why the SDK matters
Modern account-protection tools run a small agent in the browser, then decide on the server. AbuseGraph works the same way. You can call the REST endpoint alone — email, IP, and graph still score — but without the SDK you miss mouse movement, typing rhythm, and the rest of the behavioral layer. That check is simply less impactful.
Browser SDK
Recommended- Full behavioral monitoring while the page is open
- Device probes + automation checks before submit
- Richer verdict — closer to what fraud agents ship
API only
Works, thinner- Email, IP, breach, and graph still score
- No mouse, typing, or in-page behavior
- Fine for server-only flows — less impactful at signup
Behavioral scoring in the browser
Mouse and pointer paths, typing rhythm, clicks, and synthetic events — signals a bare API call never sees.
Collect early, decide at signup
Init on page load so monitoring runs while the form is open. Collect and evaluate at signup or login, then let your server check and enforce the decision.
Publishable keys only
pk_live_ / pk_test_ stay in the browser. Secret sk_ keys never leave your server.
Works out of the box
Production API endpoints are the default. Retries and fail-open keep signup working if the network blips.
What the SDK monitors
Behavior
- ▸ Mouse & pointer movement
- ▸ Typing timing
- ▸ Click-without-mouse
- ▸ Synthetic / replayed events
Device
- ▸ Canvas & WebGL
- ▸ Headless / automation
- ▸ Client hints
- ▸ Private-mode checks
Session + edge
- ▸ TLS consistency
- ▸ Network & bot score
- ▸ Cookies & channel
- ▸ Fingerprint confidence
Try it on yourself first — run the live demo and move the mouse before the check scores.
Install in minutes
Load early, call at the sensitive action, finish the decision on your server. Publishable keys (pk_…) in the browser · secret keys (sk_…) on the server.
Step 1 — Install
AbuseGraph SDK
<script src="https://abusegraph.com/sdk/abusegraph.min.js" defer></script>
<script>
let abusegraphSdk;
function initAbuseGraph() {
if (!window.AbuseGraph) {
console.error("AbuseGraph SDK failed to load");
return;
}
abusegraphSdk = window.AbuseGraph.init({
publicKey: "pk_test_…",
edgeUrl: "https://api.abusegraph.com"
});
}
// A deferred script runs before DOMContentLoaded. This also works when this
// snippet is evaluated after that event has already fired.
if (document.readyState === "loading") {
document.addEventListener("DOMContentLoaded", initAbuseGraph, { once: true });
} else {
initAbuseGraph();
}
// Call at signup/login; send the returned body to your server. Keep sk_ there.
async function collectForAuth(email, event = "signup") {
if (!abusegraphSdk) throw new Error("AbuseGraph SDK is not ready");
const collected = await abusegraphSdk.collect();
const edge = await abusegraphSdk.evaluate(collected, { email });
return abusegraphSdk.toCheckBody(collected, {
email,
event,
verdictToken: edge.verdictToken?.token || undefined,
});
}
</script>Collect while the form is open, then evaluate and send toCheckBody to your server for the authoritative check.
Step 2 — Env
# Browser — publishable key only
NEXT_PUBLIC_ABUSEGRAPH_PUBLISHABLE_KEY=pk_test_…
# Optional: NEXT_PUBLIC_ABUSEGRAPH_EDGE_URL=https://api.abusegraph.com
# Server — secret key (never ship in a browser bundle)
ABUSEGRAPH_SECRET_KEY=sk_test_…
ABUSEGRAPH_SITE=yourdomain.com
ABUSEGRAPH_CHECK_URL=https://abusegraph.com/api/v1/check
# Live checks: send header x-abusegraph-site: $ABUSEGRAPH_SITEStep 3 — Submit
async function submitAbuseGraphSignup(email) {
const browserFields = await collectForAuth(email, "signup");
const response = await fetch("/api/auth/signup", {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify(browserFields),
});
if (!response.ok) {
throw new Error(`Signup was not accepted (${response.status})`);
}
return response.json();
}This calls your own /api/auth/signup route. Keep the secret key there and gate account creation on its server-side check. Call this function from your signup form handler.
Step 4 — Server check
curl -X POST https://abusegraph.com/api/v1/check \
-H "x-api-key: $ABUSEGRAPH_SECRET_KEY" \
-H "x-abusegraph-site: acme.com" \
-H "content-type: application/json" \
-d '{
"email": "user@example.com",
"event": "signup",
"site": "acme.com"
}'Browser evaluate is preliminary. Your backend check with sk_… is authoritative. API docs → · Guides →