Ory integration
Refuse disposable emails and repeat signups in Ory
Ory can call a web hook after someone sends the registration form and before it creates the identity. Set SignupBouncer as that hook, and we check each signup and refuse the ones marked block. You add an action in Ory, or a few lines to your Kratos config, and change no code in your app.
- Get a free key. You create an API key on your app's Integration tab.
- In Ory, add a web hook action to the registration flow, after, for each sign-up method you use. On self-hosted Kratos, you add the hook to your Kratos config.
- Register with a test address, and find the signup on the Checks tab. Watch your signups in shadow mode, then switch the app to enforce.
What SignupBouncer refuses
Ory sends us the new identity's email address, and the signup's IP when Ory has one. In enforce mode, we refuse a signup marked block. On every plan, the email checks look for:
- a disposable email domain, or a new domain whose mail goes to a known burner mail server
- a domain that can't receive email
- the same inbox signing up again under another spelling, such as Gmail dots or a
+tag. Each repeat within 7 days adds points.
On the Starter plan and up, the signup's IP adds points when it comes from a datacenter, a VPN, Tor or a hijacked network. On the Free plan, we run the IP checks too, and your log lists what they found.
Full setup in the docs
For the full setup, read the Ory web hook page in our docs. You can add the hook in the Ory Console or in your Kratos config, and take it out again in the same place.
More
- Ory in our docs, next to the REST API and the reason codes.
- Ory's guide to web hooks.
Start on the Free plan
1 app and 1,000 checks a month. No card. Shadow mode logs what we would refuse until you switch the app to enforce.