Quickstart
Configure with a test secret, POST /api/v1/check, read verdict and score.
Test keys never bill
Create a free account → finish setup → copy sk_test_… from the console. Free includes 1,000 live API checks / month after DNS verify.
Get a test key
Copy sk_test_… from the console Keys page. Live keys refuse localhost — local tooling must use test keys.
Hit check
curl -X POST https://abusegraph.com/api/v1/check \
-H "x-api-key: $ABUSEGRAPH_SECRET_KEY" \
-H "content-type: application/json" \
-d '{"email":"user@example.com","event":"signup","site":"yourdomain.com"}'x-abusegraph-site is optional for sk_test_…. Required for sk_live_….
Read the decision
Match on verdict: allow | challenge | shadow | block. Use score (0–100) and reasons in logs and review queues. You enforce — we do not block traffic for you.
Try the same request in the Risk Check playground.
Next
- Wire the browser SDK so the check includes device and behavior.
- Pick a guide for your auth stack.
- Server helper:
@abusegraph/servercreateCheckClient.