Firebase integration
Refuse disposable emails and repeat signups in Firebase Auth
Firebase runs a blocking function before it creates a user. You add our check as that function, and we refuse each signup marked block. Blocking functions need Firebase Authentication with Identity Platform.
- Get a free key. You create an API key on your app's Integration tab.
- Add our two files to your functions, and store your key as a Firebase secret. Then deploy your functions.
- Sign up with a test address, and find the signup on the Checks tab. Watch your signups in shadow mode, then switch the app to enforce.
What SignupBouncer refuses
The function sends us the new user's email address and IP address. In enforce mode, we refuse a signup marked block. On every plan, the email checks look for:
- a disposable email domain, or a new domain whose mail goes to a known burner mail server
- a domain that can't receive email
- the same inbox signing up again under another spelling, such as Gmail dots or a
+tag. Each repeat within 7 days adds points.
On the Starter plan and up, the signup's IP adds points when it comes from a datacenter, a VPN, Tor or a hijacked network. On the Free plan, we run the IP checks too, and your log lists what they found.
Full setup in the docs
For the full setup, read the Firebase Auth page in our docs, which prints both files the blocking function needs.
More
- Firebase Auth in our docs, next to the REST API and the reason codes.
Start on the Free plan
1 app and 1,000 checks a month. No card. Shadow mode logs what we would refuse until you switch the app to enforce.