# signupbouncer

> SignupBouncer is an API that checks new signups for disposable emails, Gmail aliases and repeat accounts. Each check answers allow, challenge or block, with a score and the reasons. It looks at the email (disposable domains, domains that cannot receive mail, mail servers classified as burner mail hosts, Gmail dot and +tag aliases, the same inbox checked again) and, on paid plans, the IP (datacenter, VPN, Tor). It is built for AI apps whose free credits get farmed with throwaway accounts.

## Pages

- [Docs](https://signupbouncer.com/docs): Supabase install, REST API, code per stack, testing, reason codes, shadow and enforce, MCP,
  data handling
- [Guides](https://signupbouncer.com/guides): how-to articles, listed under Guides below
- [Sign up](https://signupbouncer.com/signup): a free account with an email address and a password, no card. You create API keys per
  app on the dashboard
- [OpenAPI](https://signupbouncer.com/openapi.json): the REST API as an OpenAPI 3.1 document
- [Pricing](https://signupbouncer.com/pricing): plans and limits
- [Disposable email checker](https://signupbouncer.com/disposable-email-checker): check one email (and IP) in the browser, no
  account. What each check looks at, the one API call for a signup flow, and answers to common questions
- [Signup audit](https://signupbouncer.com/audit): check an app's existing users without installing anything. Run one SQL query
  (Supabase, Postgres, MySQL) or paste a list of addresses. Only email domains and counts are sent, and the answer
  is how many accounts are on burner domains or repeat the same Gmail inbox
- [Burner domains](https://signupbouncer.com/burner/): disposable domains our harvester found on temp-mail sites or with mail
  servers classified as burner mail hosts, and the domains of well-known temp-mail services such as
  https://signupbouncer.com/burner/mailinator.com, one page each. The public part of our list is a plain text file, one domain per
  line, at https://github.com/signupbouncer/burner-domains (raw file: https://raw.githubusercontent.com/signupbouncer/burner-domains/master/burner-domains.txt)
- [MCP server](https://signupbouncer.com/docs#mcp): https://signupbouncer.com/mcp, the free checker and the code per stack as tools for AI assistants
- [Full text for LLMs](https://signupbouncer.com/llms-full.txt): everything here plus the API, the code per stack, reason codes and
  data handling

## Install

- Supabase auth hook (no code): in the Supabase dashboard open Authentication, Hooks, add a "Before User Created"
  HTTPS hook, and paste the hook URL (https://signupbouncer.com/hook/supabase/app_...) and hook secret (v1,whsec_...) from the
  signupbouncer dashboard. Details: https://signupbouncer.com/docs#supabase
- REST API: POST https://signupbouncer.com/v1/check with "Authorization: Bearer sb_live_..." from any backend, before creating the
  user. The same call works from Better Auth, Next.js, Express, Hono, Firebase, Python or any other server code.
  Tested code for each stack: https://signupbouncer.com/docs#code (also in https://signupbouncer.com/llms-full.txt). OpenAPI 3.1 description:
  https://signupbouncer.com/openapi.json. Details: https://signupbouncer.com/docs#api
- MCP (for AI assistants and agents): add the remote server https://signupbouncer.com/mcp (Streamable HTTP, no sessions, no key
  needed). Tools: integration_guide (the steps and code for one stack: supabase, fetch, nextjs, express, hono, python,
  firebase or better-auth), check_email (allow, challenge or block, the score and reasons for one address and optional IP, plus a corrected address when the domain
  looks like a typo), explain_reason
  (what a reason code means) and lookup_burner_domain (whether a domain is on the burner list, with no DNS lookup). check_email and
  lookup_burner_domain are the free checker. They allow 20 checks a minute and 200 a day per IP
  address, shared with the checker at https://signupbouncer.com/disposable-email-checker, and store nothing. Assistants hosted by their provider call from the
  provider's servers and share its IP addresses. Send your API key as "Authorization: Bearer sb_live_..." on /mcp for
  your account's own free allowance: 20 checks a minute and 200 a day per account, not counted as checks against
  your plan. A key that is sent but not valid gets a 401. check_email counts every reason,
  including reasons that count only on paid plans, so its score can differ from your app's. Details: https://signupbouncer.com/docs#mcp

New apps start in shadow mode. Signups are checked and logged, and nothing is blocked. Act on the "action"
field, never on "verdict". In shadow mode "action" is always "allow". When calling the REST API, give the call a short
timeout and allow the signup if it fails or times out, so a problem on our side never blocks your users. The Supabase
hook does this for you while its Cloudflare Worker is reachable. Our server answers allow when it hits an error or
takes longer than 1.2 seconds, and the Worker answers allow when our server is down or does not answer within 1.5
seconds. If Supabase cannot reach the Worker (a Cloudflare failure, for example), Supabase refuses the signup.

## Get a key

Sign up at https://signupbouncer.com/signup with an email address and a password. The Free plan needs no card. The Supabase hook needs
no API key. The dashboard's Integration tab shows each app's hook URL and hook secret. For the REST API, the account
owner chooses "Create API key" on that app's Integration tab. Each key belongs to one app, and its checks are logged
under that app. The key (sb_live_...) is shown once, because we store only a hash of it. Save it in your server's
environment as SIGNUPBOUNCER_API_KEY. "Rotate" makes a replacement and keeps the old key working for 24 hours.

## Testing

Check someone@mailinator.com to see it marked block. New apps start in shadow mode, so "action" stays "allow" until
you switch the app to enforce in the dashboard. Test checks count toward your monthly allowance. Retries of the same
exact address on one app count as one signup in the windows. Different aliases or apps count separately and can add
repeat_inbox points for 7 days. Gmail dots and +tags share an inbox. Use a new address for independent tests.
For IP-only checks, send a stable attempt_id (1 to 128 letters, digits, . _ : or -) and reuse it on retries. Without an
address or attempt_id each call counts separately. This deduplicates counters, not billing or API responses.

## Scope

signupbouncer scores a signup's email address and IP address, and on the Pro plan, bursts of signups. Captchas, phone
number checks, device fingerprinting and mailbox (SMTP) probing are outside it. Pair it with another tool for those.
Residential-proxy detection is coming on the Pro plan. A signup marked challenge is suspicious but not a block,
and you choose what your app does with it.

## Guides

- [Block burner emails in the Next.js SaaS starter](https://signupbouncer.com/guides/nextjs-saas-starter): Add a signupbouncer check before password hashing, then switch to Enforce to refuse disposable addresses and limit repeat signups from one inbox.
- [Build an AI image generator with Next.js and Supabase](https://signupbouncer.com/guides/ai-image-credits): Give users 10 free credits, track image usage, and use a Supabase hook to block disposable emails and limit repeat Gmail signups.

## Pricing

Per account, with checks pooled across all apps. Every plan is on sale. Features marked "coming" are not live yet.

- Free: $0, 1,000 checks a month, 1 app. Email checks: burner domains, burner mail servers, domains that cannot receive mail, Gmail dot and +alias tricks, repeat inboxes. IP and velocity checks run too and are listed as what a paid plan would add, without adding to the score. Never billed. Over 1,000 checks in a month, signups are let through unchecked until the month ends.
- Starter: $19 a month or $190 a year, 10,000 checks a month, 3 apps. Everything in the Free plan. Datacenter, VPN and Tor IP checks count toward the score. Monthly billing: extra checks at $2 per 1,000, up to a $38 monthly cap you can change. Yearly billing: no extra checks.
- Pro: $49 a month or $490 a year, 50,000 checks a month, unlimited apps. Everything in the Starter plan. Velocity rules count toward the score: bursts of signups from one network, one hosting or VPN network, one inbox in several spellings, or one name-and-number address pattern. Residential-proxy detection (coming). Monthly billing: extra checks at $2 per 1,000, up to a $98 monthly cap you can change. Yearly billing: no extra checks.
- Scale: $129 a month or $1,290 a year, 250,000 checks a month, unlimited apps. Everything in the Pro plan. Team seats. Export of the burner-domain feed. Monthly billing: extra checks at $2 per 1,000, up to a $258 monthly cap you can change. Yearly billing: no extra checks.

The billing rules (extra checks and their cap, plan changes, failed payments, cancelling and refunds) are in
https://signupbouncer.com/llms-full.txt and the Terms of Service (https://signupbouncer.com/terms). For a question about a payment, email
support@signupbouncer.com.

## Optional

- [Privacy Policy](https://signupbouncer.com/privacy): what is collected about customers and checked signups, who handles it, how long
  it is kept
- [Terms of Service](https://signupbouncer.com/terms): the terms of use, including the billing rules (extra checks and their cap, plan
  changes, failed payments, cancelling and refunds)
- [Status](https://signupbouncer.com/status): live state of the check API, the Supabase hook and the data, and recent incidents
  (also https://signupbouncer.com/status.json)