# AbuseGraph

> Account protection API — score signup/login risk with a verdict and reasons. You keep enforcement. Free includes 1,000 live checks / month after DNS verify.

## Start here (for AI agents)

- [Agent integration prompt](https://abusegraph.com/llms-full.txt): Paste into Cursor / Claude / ChatGPT / Copilot. Optional `?stack=clerk` (or better-auth, nextjs, ios, …).
- [Human page + copy UI](https://abusegraph.com/agents): Pick a stack and copy the prompt.
- [Interactive API docs](https://abusegraph.com/docs): OpenAPI + try Risk Check with `sk_test_…`.
- [OpenAPI JSON](https://abusegraph.com/openapi.json)

## Product

- [Home](https://abusegraph.com/)
- [How it works / browser SDK](https://abusegraph.com/how-it-works)
- [Live demo](https://abusegraph.com/demo)
- [Pricing](https://abusegraph.com/pricing)
- [Detection](https://abusegraph.com/detection)

## Integrate

- [Integrations index](https://abusegraph.com/integrations)
- [All guides](https://abusegraph.com/guides)
- [Better Auth](https://abusegraph.com/guides/better-auth): Hook user create / sign-in with createCheckClient. Forward browser toCheckBody for a full score.
- [Clerk](https://abusegraph.com/guides/clerk): Webhook user.created / session.created with sk_. Forward browser signals via unsafe_metadata.
- [Supabase](https://abusegraph.com/guides/supabase): Edge Function on signup/login with createCheckClient-equivalent fetch. Forward SDK toCheckBody.
- [NextAuth / Auth.js](https://abusegraph.com/guides/nextauth): createUser / signIn events → createCheckClient. Forward browser toCheckBody from the client.
- [Next.js App Router](https://abusegraph.com/guides/nextjs): Server Action with createCheckClient; browser SDK toCheckBody before createUser.
- [Express / Node](https://abusegraph.com/guides/express): Middleware before session create — signup and login events with sk_.
- [Auth0](https://abusegraph.com/guides/auth0): Post-Login Action scores signup vs login; block or enable MFA on challenge.
- [Firebase Auth](https://abusegraph.com/guides/firebase): beforeUserCreated / beforeUserSignedIn blocking functions with sk_.
- [Cloudflare Workers](https://abusegraph.com/guides/cloudflare): Browser SDK on the site; Worker proxies /api/v1/check with sk_ secrets.
- [Python](https://abusegraph.com/guides/python): requests POST to /api/v1/check with sk_ + site on register/login.
- [Go](https://abusegraph.com/guides/go-backend): net/http client with sk_ + x-abusegraph-site for signup/login.
- [cURL / direct API](https://abusegraph.com/guides/curl): Hit /api/v1/check with sk_test_…. Free: 1,000 live checks / mo after DNS verify.
- [CDN / script tag](https://abusegraph.com/how-it-works#sdk): Load abusegraph.min.js, init with pk_, collect → server check with sk_.
- [iOS (Swift)](https://abusegraph.com/guides/ios): Native session→check SDK. Proxy sk_ from your backend; fail-open.
- [Android (Kotlin)](https://abusegraph.com/guides/android): Native Kotlin session→check. Proxy sk_ from your backend; fail-open.
- [React Native](https://abusegraph.com/guides/react-native): @palisade/sdk-react-native session→check — same API as native.

## Auth model (remember)

- `sk_test_…` / `sk_live_…` — secret, server only → `POST /api/v1/check` with header `x-api-key`
- `pk_test_…` / `pk_live_…` — publishable, browser SDK → evaluate on api.abusegraph.com
- Live secrets also need header `x-abusegraph-site: licensed-hostname`
- Never invent live keys. Never put `sk_` in a client bundle.

## Optional

- [Blog](https://abusegraph.com/blog)
- [Resources](https://abusegraph.com/resources)
- [Comparison](https://abusegraph.com/comparison)
- [Alternatives](https://abusegraph.com/alternatives)
- [Security disclosure](https://abusegraph.com/security)
- [security.txt](https://abusegraph.com/.well-known/security.txt)
- [Privacy](https://abusegraph.com/privacy)
- [Terms](https://abusegraph.com/terms)