Arcjet alternative for signup abuse and repeat accounts

We read Arcjet's docs and pricing pages on Oct 29, 2026.

What Arcjet does well

Arcjet's SDK runs bot detection, rate limits and Arcjet's firewall rules in the same call as the email check. Bot detection and rate limits stop scripted form posts that SignupBouncer never sees.
Every plan flags IPs from hosting providers, VPNs, proxies, Tor and relays. On SignupBouncer, IP checks count toward the score from the Starter plan up.
Arcjet's email check flags disposable domains and domains without MX records. It can also flag invalid addresses, free mail providers such as Gmail, and addresses with no Gravatar picture.
Each rule runs in LIVE or DRY_RUN mode. By default, the SDK lets a request through when Arcjet doesn't answer within 2 seconds.

Gmail dots and +tags. Arcjet's docs don't say whether j.smith+2@gmail.com and jsmith@gmail.com count as the same inbox. SignupBouncer counts them as one, and adds points each time that inbox signs up again within 7 days.
Repeat accounts. Arcjet's rate limit counts requests per IP, user agent or a key you choose. Arcjet's docs don't describe a record of past signups that would show the same inbox coming back.
Supabase. Arcjet's docs have no Supabase auth hook. You add SignupBouncer as Supabase's Before User Created hook, with no code.
Changing the email rule without a deploy. Arcjet's email validation is set in code only. On SignupBouncer, you switch between shadow mode and enforce mode, and set both score cutoffs, in the dashboard.

You want Arcjet's SDK to protect your whole app from bots and floods of requests. Your signup route is a small part of the app you want to protect.
You want IP data on the cheapest plan. Every Arcjet plan includes IP data, including the free plan of 10,000 requests a month. Paid plans start at $25 a month plus $5 per million requests.
You have a lot of signups, and you choose on price per call. At $5 per million requests, Arcjet costs less per call than any SignupBouncer plan.

	Arcjet	SignupBouncer
How you add it	An SDK in your server code: JavaScript and TypeScript frameworks, Python or Go	A REST call from any backend, or a Supabase hook with no code
Disposable domains	Yes	Yes, plus a lookup of the mail server behind each new domain
Domains that can't receive mail	Yes	Yes
Gmail dots and +tags as one inbox	Not in the docs	Yes, on every plan
The same inbox signing up again	Not in the docs	Adds points for 7 days, on every plan
Bot detection and rate limits	Yes	No
Datacenter, VPN and Tor IPs	Every plan	Counts from the Starter plan. The Free plan logs what it found
Signup bursts from one network	A rate limit you configure	Counts from the Pro plan
What a check answers	Allow, deny, challenge or error	Allow, challenge or block, with a score and its reasons
Trying it before it refuses anyone	DRY_RUN mode, set in code for the email rule	Shadow mode, the default for new apps, switched in the dashboard
Free plan	10,000 requests a month after a 15-day trial	1,000 checks a month, no card, no trial
First paid plan	$25 a month, plus $5 per million requests	$19 a month for 10,000 checks

Create a free account and open your app's Integration tab.
- If you call us from your code, pick Your own backend on that tab and create an API key. Then follow the code for your stack to send us the email and client IP before you create the user.
- If you're on Supabase, add a Before User Created hook instead, with the hook URL and the hook secret from the Integration tab. If the secret doesn't match, we let every signup through unchecked.
Keep Arcjet's bot detection and rate limit if you use them. Arcjet and SignupBouncer can both check the same signup.
Watch your signups on the Checks tab in shadow mode. When the results look right, switch the app to enforce.

We read each of these pages on Oct 29, 2026.