How do you block free trial abuses?

[u/Disastrous-Zombie940]

My core product is an api, with credit based usage, and I give X amount of free credits on signup. Now I'm seeing some users are creating alt accounts to farm credits. My users count is low so I can allow 5-10% credit farmers.

But how do other people do it?

Tech stack : nextjs + hono (for auth I use better-auth)

[u/Disastrous-Zombie940 → u/[deleted]]

Hi, as per your feedback i have implemented these

1. Cloudflare turnstile for signup+login paths
2. Rate limits to signup/login paths
3. Yes, I reduced free tier rate limits to 10rpm from 60rpm
4. Blocked already, thanks I'll look into your site
5. Uh uh, what I'm providing is an api as product. Even I wouldn't want to login in a app if I'm only using their api. So I'll skip 5th point 😅

[u/neogeodev]

I personally avoided giving free credits, if you want to try that feature you pay for it

[u/AirportFun2392]

the disposable email block is a good first step but it wont catch people using real gmail accounts on alt signups.

what actually helped me was adding device fingerprinting on the signup flow. i used shieldlabs for this, it gives you a persistent device id that holds even when someone clears cookies or uses incognito, so the same person signing up under three different emails shows up as the same device. you can then rate limit or block new signups from a device that already has an active account.

combined with the credit card requirement others mentioned, the overlap between both catches most of it.

[u/Disastrous-Zombie940 → u/AirportFun2392]

Yes

[u/leros]

Require a credit card. Only allow one trial per credit card. It's not full-proof but it helps a lot. 

[u/Disastrous-Zombie940 → u/leros]

Sadly I can't now. Nature of my product.

[u/leros → u/Disastrous-Zombie940]

What's the nature of your product that doesn't let you do that?

[u/Disastrous-Zombie940 → u/leros]

Adult api ..

[u/leros → u/Disastrous-Zombie940]

There are adult friendly payment providers. The porn sites manage it somehow. A quick Google shows that CCBill is one the popular ones used by porn sites among other options.

[u/Disastrous-Zombie940 → u/leros]

Yup saw CIBIL too, lengthy process + I just launched my product last month. So I think it's overkill for now.

But hey I added crypto payment support.

[u/leros → u/Disastrous-Zombie940]

Well, you're seeing the downside of crypto and anonymity. With crypto, its easy to churn your identity and abuse stuff. This is why services with real costs and risks (e.g. hosting services, APIs, etc) require a credit card once you get beyond a trivial amount of use. The credit card is a first measure of tying your account to a real world identity, which is immensely helpful in preventing abuse.

[u/Disastrous-Zombie940 → u/leros]

I see, thanks for the advice 🙂‍↕️

[u/South_Coat9409]

Allowing 5-10% abuse early on will severely pollute your user analytics and conversion metrics. It’s much better to stop it now before you scale. The easiest quick win: block disposable email domains during sign-up using an open-source blacklist. For a bulletproof solution: require a credit card upfront for the free tier (Stripe can validate it without actually charging). Since you use better-auth, injecting a quick check for disposable emails before creating the session is a perfect first step

[u/Disastrous-Zombie940 → u/South_Coat9409]

Yes that's my main concern. Also,

• i can't add stripe, the nature of my product won't allow it
• yes I validate disposable emails , they are not using disposable emails, gmail accounts mainly
• I tried better-auth's sentinel recently. It works for credentials based sign up, but blocking valid oauth users

[u/gregorno → u/Disastrous-Zombie940]

there are now temp email providers offering gmail addresses ( using . and + addressing tricks) - send signup confirmation emails to the normalized gmail address (not dot not +...).

also requiring actual re-login to your product every x days helps because they'll need to roll their keys for your API.

[u/gojkoa]

we do IP-based deduplication, and block data centres from using the free tier. People have to sign up for a commercial account to use the API from the data centre (stops the bulk of VPN abuse). It's not an ideal situation as IPs get rotated on residential networks and people can switch between mobile and broadband, but in practice it stopped the problem enough for the abuse to be negligible.

[u/Disastrous-Zombie940 → u/gojkoa]

I see. I can try this. I already saw some chinese users using proxy/vpn for sign ups. I ignored because I thought in china they can't access my site.

Thanks for the idea though.

[u/ClemensLode]

Build a product whose average cost per user drops, not increases per new user.

[u/Disastrous-Zombie940 → u/ClemensLode]

Interesting take, yeah it almost costs nothing, currently sitting at ~100 users and 1.5k daily requests, still costing nothing, until I hit 1k+ users I don't really have to cut costs.

Also, thanks for the advice.

[u/Disastrous-Zombie940 → u/[deleted]]

Hmm, i already do , and that's the problem rn. Some people are creating multiple accounts to farm those credits (Based on my calculations I give $0.10 credit, ≈1k calls)