Buy Trial-Abuse Shield.
Screen signup risk and trial abuse before free compute drains your margin. Real-time synchronous verdict.
Drop-In Integration Stage
OpenAPI 3.1 & Gateway Compatibleimport httpx
response = httpx.post(
"https://api.youstostore.com/v1/assess-signup",
headers={"X-API-Key": "sk_live_your_key"},
json={
"email": "temp_tester_99@tempmail.com",
"ip": "185.220.101.5",
"event": "signup",
"occurred_at": "2026-09-13T16:00:00Z"
}
)
print(response.json()) # {"verdict": "blocked", "risk_score": 0.94}Evaluate Disposable Email & IP Risk in Real Time
Test burner domains and bot signup payloads against our fraud shield.
Disposable email domain + VPN IP velocity detected
Starter Shield
Pro Fraud Guard
POPULAREnterprise Shield
Protect paid trial capacity without hiding the reason
Trial-Abuse Shield gives metered SaaS teams a compact risk assessment before they grant a free trial or redeem promotional credit. Send the email, IP address, event type, estimated trial cost, and event time. The API returns a risk score, an `allow`, `review`, or `block` recommendation, weighted reason codes, and a deterministic decision ID.
Engineering Pain & Fragility
Free trials are not free to the company providing them. AI inference, data enrichment, rendering, storage, messaging, and other metered features create a real cost before a user pays. A small number of people can consume that budget repeatedly through disposable inboxes, plus-address aliases, coordinated redemptions, or other cheap variations on the same signup.
Blanket blocking is a poor answer. Shared networks, privacy tools, legitimate aliases, and unusual email domains can all resemble abuse. A rule that silently rejects every suspicious signal will block good prospects and leave support teams unable to explain why.
Trial-Abuse Shield turns a defined set of request signals into a consistent, inspectable decision. Rather than returning a single opaque label, it shows the score contribution behind the recommendation. That makes it easier to shadow-test rules, route uncertain cases to review, and set stricter controls when the trial cost is high.
What the API Solves
Call `POST /v1/assess-signup` for either a `signup` or `credit_redemption` event. The API validates the email and IP formats, evaluates the supplied signals, caps the risk score at 100, and maps the score to a recommendation:
- `allow` for scores below 30 - `review` for scores from 30 through 79 - `block` for scores of 80 or more
The current implemented rules can flag a known disposable email domain, a plus-address alias, a non-public IP address, and a high-cost credit redemption. Each triggered rule contributes a named integer weight. For example, the response can explain that a disposable domain added 60 points and alias behavior added 25, rather than returning an unsupported claim that the user is a fraudster.
The decision ID is derived deterministically from the authenticated tenant, normalized email, IP address, and event timestamp. Repeating the same assessment input within the same tenant produces the same identifier, which helps with traceability and deduplication in your own workflow.
How it works. Step by step.
Collect the event inputs.
Provide the account email, source IP, event type, UTC event timestamp, and optional estimated trial cost.
Call the assessment endpoint.
Authenticate with `X-API-Key` and send the JSON body before granting the trial benefit or promotional credit.
Evaluate the signals.
The service applies its defined rules and records a reason code and weight for every match.
Calculate the score.
Weights are added and capped at 100.
Map score to recommendation.
The response recommends `allow`, `review`, or `block` according to the documented thresholds.
Apply your policy.
Use the recommendation as one input to your decision. Log the decision ID, send medium-risk cases to review, or run the API in shadow mode before taking action.
Built for enterprise production standards.
One synchronous endpoint for signup and credit-redemption assessments
Deterministic decision IDs within a tenant for repeated identical inputs
Integer risk score from 0 to 100
Explicit `allow`, `review`, and `block` recommendations
Weighted, machine-readable reason codes
Support for estimated trial cost up to $10,000 per event
Strict request schema with email, IP, event, and timestamp validation
Tenant-scoped API-key authentication and rate limiting
Structured JSON errors with request IDs
Usage metering, JSON request logs, liveness/readiness probes, and Prometheus metrics
Ideal use cases & engineering workflows.
Trial-Abuse Shield is for SaaS teams whose free tier has a cost: AI products, data APIs, rendering platforms, developer tools, and messaging products. It suits product, risk, growth, and trust-and-safety teams that need a decision API without committing to an identity stack.
The product is less suitable when you need proof of identity, device fingerprinting, payment fraud detection, sanctions screening, or an autonomous rejection system with no internal policy layer.
Shadow-score new signups
Call the API without changing the customer journey. Compare recommendations with activation, conversion, support tickets, and known abuse outcomes before enforcing any rule.
Prioritize manual review
Send `review` recommendations to an operations queue. Include the decision ID, score, and reason codes so an analyst can see what drove the result.
Guard expensive trial grants
Use the optional `trial_cost_usd` field to represent the expected cost of the benefit. The current rule set applies a high-cost reason to credit-redemption events at or above $100.
Check promotional credit redemption
Assess an account again when it tries to redeem a credit, even if signup was previously allowed. Redemption is a separate event type and may carry different economics.
Tune product policy by risk band
An `allow` recommendation might receive the normal trial. A `review` recommendation might receive a smaller allowance pending verification by your own process. Your application owns these actions; the API only supplies the assessment.
Why buy instead of building internally?
A few signup rules look easy to add directly to application code. They tend to spread: one branch in signup, another in credit redemption, a background query for analysts, and a third copy in a data warehouse. Soon the thresholds differ and nobody can reconstruct why an account was stopped.
A dedicated endpoint gives you one request shape, deterministic references, weighted reasons, authentication, rate limits, request IDs, and metrics. It also separates the risk signal from the business action. Buy when the documented rules cover a useful first pass. Build when abuse detection is a core differentiator, you need a custom device graph or model, or your policy depends on signals this API does not accept.
Security, privacy and operational integrity.
Protected endpoints require `X-API-Key`; the provided key stores retain a SHA-256 digest rather than the plaintext key. Authentication and rate limiting are scoped by tenant. Missing, invalid, or revoked keys return a structured `401`; rate-limit responses return `429` with `Retry-After`.
The middleware assigns or preserves a request ID and returns it as `X-Request-ID`. Validation and domain errors use a consistent `{error: {code, message, request_id, details}}` envelope. Request logs record method, route, status, and request context without logging the submitted email or IP body.
The assessment itself is deterministic for the same tenant and inputs. That repeatability supports testing and investigation, but it does not make the recommendation objectively correct. Monitor outcomes and false positives, especially where shared networks, aliases, or unusual account patterns are common.
Architectural Scope & Production Boundaries
Questions & answers for engineering leads.
No. It does not prove who a person is or verify government documents, phone ownership, payment ownership, or device identity. It returns a risk signal for your own signup or credit policy.
Deploy Trial-Abuse Shield in minutes.
Start with our developer tier on Polar.sh Merchant of Record. Automated EU VAT invoices, instant API key generation, and 99.99% edge uptime SLA.