SignupBouncer

Checks one email address, and optionally the signup's IP address, the way SignupBouncer checks a new signup. Returns the result as "verdict" (allow, challenge or block), a 0-100 score, the reasons with their reason codes, the normalised inbox (Gmail dots and +tags folded) and the IP's network. When the domain looks like a typo of a big mail provider (gmial.com), "suggestion" holds the corrected address. Looks up the domain's mail servers live. Every reason is listed, including ones only paid plans count. Nothing sent is stored.

Explains a SignupBouncer reason code (for example disposable_domain, burner_mx, repeat_inbox, datacenter_ip): what it means, how many points it adds or whether it blocks alone, and the lowest plan on which it counts. Without a code, lists every code.

Says whether a domain is on SignupBouncer's disposable (burner) email list, only on an old burner list (a challenge, not a block), a known relay service or a free subdomain mail service, or a known real mailbox provider, and when our harvester observed it. Uses only the loaded lists, no DNS lookup, so a brand-new burner domain on a burner mail server is caught only by check_email. Accepts a domain or an email address.

Returns the steps and the copy-paste code that checks new signups with SignupBouncer in one stack: supabase (a hook, no code), ory (a web hook, no code), fetch (any TypeScript server), nextjs, express, hono, python, firebase or better-auth. Use it when the user is building or changing a signup, register or auth flow. The code reads the API key from SIGNUPBOUNCER_API_KEY. The call has a 1.5-second limit, and any failure lets the signup through.

Needs an API key. Returns the Rules settings of one of your apps: shadow or enforce mode, the challenge and block score cutoffs, what a challenge does in the Supabase and Ory hooks, the message a refused person sees, the "Why was this refused?" link, the velocity thresholds and the setting of each check. The context part lists your plan, the checks that need a higher plan, the values each check takes and the defaults. A key made for one app reads that app, so leave out "app". An older all-apps key needs "app".

Needs an API key. Changes the Rules settings of one of your apps, which changes live signup blocking for that app: the next real signups are scored and refused under the new settings. Send only the settings to change. The others stay as they are. Setting mode to "enforce" starts refusing signups marked block, and "shadow" stops refusing any. If one value is wrong, nothing changes and the answer says which. Returns the app's rules afterwards, with the settings that changed. Confirm the change with the user first. A key made for one app changes that app, so leave out "app". An older all-apps key needs "app".