DEV Community

Cover image for How I Stop Fake Signups From Farming Free Credits (JS/Python)
Ishan Shrestha
Ishan Shrestha

Posted on Originally published at Medium

How I Stop Fake Signups From Farming Free Credits (JS/Python)

#api #webdev #python #javascript

A few client apps had the same leak.

They offered free credits so people could try the product. Normal and fair. Then throwaway emails showed up, grabbed the free stuff, and disappeared. Support time went up. Costs went up. Real users got a worse experience.

We tried free tools. One helped for a while. One broke at the worst time. After patching this more than once, I wanted one simple rule for signup:

If the email looks abusive or undeliverable, block quietly and move on.

That is what I built into: https://emailscore.neuralevo.com/

This post is the practical version: what to check, and copy-paste code in JavaScript and Python.

The rule that matters

Call the validate API and gate on verdict.

  • allow: continue signup / trial
  • block: stop with a neutral message

You can inspect other fields later. For signup abuse, start with verdict.

POST https://api.emailscore.neuralevo.com/api/v1/validate/email

Header:

Authorization: Bearer YOUR_API_KEY

JavaScript (Node fetch) 

async function shouldAllowSignup(email, apiKey) {
  const response = await fetch(
    "https://api.emailscore.neuralevo.com/api/v1/validate/email",
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${apiKey}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ email }),
    }
  );

  if (!response.ok) {
    throw new Error(`Validate failed: ${response.status}`);
  }

  const data = await response.json();

  // Primary signup gate
  return data.verdict === "allow";
}

// Example
const ok = await shouldAllowSignup(
  "ada@company.com",
  process.env.EMAIL_SCORE_API_KEY
);

if (!ok) {
  // Show a neutral error. Do not explain the abuse logic.
  console.log("Please use a different email.");
}
Enter fullscreen mode Exit fullscreen mode

Python (requests) 

import os
import requests

def should_allow_signup(email: str, api_key: str) -> bool:
    response = requests.post(
        "https://api.emailscore.neuralevo.com/api/v1/validate/email",
        headers={
            "Authorization": f"Bearer {api_key}",
            "Content-Type": "application/json",
        },
        json={"email": email},
        timeout=10,
    )
    response.raise_for_status()
    data = response.json()
    return data.get("verdict") == "allow"


ok = should_allow_signup(
    "ada@company.com",
    os.environ["EMAIL_SCORE_API_KEY"],
)

if not ok:
    print("Please use a different email.")
Enter fullscreen mode Exit fullscreen mode

What a response looks like 

{
  "input": "ada@company.com",
  "normalized": "ada@company.com",
  "verdict": "allow",
  "policyReason": "clean",
  "checks": {
    "syntax": "pass",
    "disposable": "miss"
  },
  "deliverability": {
    "status": "deliverable",
    "reason": "mx_found"
  }
}
Enter fullscreen mode Exit fullscreen mode

Useful extras when you need them:

  • checks.disposable: throwaway / block list hit
  • deliverability.status: can the domain receive mail
  • policyReason: why policy decided what it did

For most signup flows, still gate on verdict first.

Where this helps

  • Free trials and free credits
  • Waitlists
  • Invites
  • Any form where fake emails quietly cost money

Try it

If you want to poke at it without wiring code first, there is a free checker on the homepage:
https://emailscore.neuralevo.com

There is also free API access for devs.

If you try the snippets, tell me what broke or felt unclear. I am still improveing this from more client pain, so blunt feedback helps more than polite compliments.

Originally published on Medium.

Top comments (0)