Docs

Add the agent to your signup page, call one endpoint from your server, act on the decision.

Quickstart

1. Add the agent to your signup page

It collects device signals and puts a short-lived visitor token in a hidden field named attrelix_visitor in every form on the page. It also exposes window.attrelix.token() for single-page apps.

<script src="https://attrelix.com/v1.js?v=0bbe74b52d" data-key="pk_live_…" async></script>

// single-page apps: wait for the token before you submit
const visitor = await window.attrelix.token();

2. Check the signup from your server

Send the e-mail, the client IP and the visitor token with your secret key. Optional: external_id (your user id), user_agent and card_fingerprint (for example Stripe's card.fingerprint).

curl https://attrelix.com/v1/check \
  -H "Authorization: Bearer $ATTRELIX_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"email":"jdoe+7@gmail.com","ip":"203.0.113.9","visitor":"vt1.…"}'

# Python
r = requests.post("https://attrelix.com/v1/check", timeout=3,
    headers={"Authorization": f"Bearer {SECRET}"},
    json={"email": email, "ip": ip, "visitor": form["attrelix_visitor"]})
decision = r.json().get("decision", "allow") if r.ok else "allow"

3. Act on the decision

allow: grant the free credits. review: ask for something that costs a farm money — a card, a phone number — or grant fewer credits. block: refuse the account or the credits. If the call fails, allow: never lock out real users because of us.

Keys and tokens

• Publishable key (pk_live_…): public by design. It sits in your page and can only collect signals, from the origins you allow in the dashboard.
• Secret key (sk_live_…): server only. It runs checks and reads results. We store only its hash: copy it when you create it.
• Visitor token: signed by us, valid for 15 minutes and for a single check, bound to your project. A token used twice, or from another network than the signup, raises the score.

POST /v1/check

Request body (JSON). Send at least one of email, ip or visitor.

Response

decision is allow, review or block. score is 0–100, the sum of the reasons' points, capped. Every reason has a stable code you can log or show.

{
  "id": "chk_3fJ8kQ2mN7pX1aZb",
  "decision": "block",
  "score": 100,
  "reasons": [
    { "code": "linked_accounts_10", "points": 45, "detail": "14" },
    { "code": "alias_of_existing", "points": 30, "detail": "3 variants of jdoe@gmail.com" },
    { "code": "datacenter_ip", "points": 25, "detail": "aws" }
  ],
  "email":   { "normalized": "jdoe@gmail.com", "disposable": false, "relay": false, "mx": "yes", … },
  "network": { "ip": "3.88.0.1", "type": "datacenter", "provider": "aws", "signups_24h": 2 },
  "device":  { "id": "dev_9c1e…", "token": "valid", "browser": "Firefox 144", "flags": ["canvas_noise"] },
  "linked":  { "accounts": 14, "by_device": 12, "by_card": 0, "cluster": "cl_7q2f…" },
  "latency_ms": 38
}

Errors

Errors are JSON: {"error": code, "message": text}.

Scoring

Scores add up and are capped at 100. Defaults: review from 50, block from 80 — both adjustable. A disposable inbox alone goes to review; no single device or network signal does.

Data sources

Disposable domains: the disposable-email-domains project (CC0) and disposable/disposable-email-domains (MIT), refreshed daily. Datacenter ranges: the published lists of AWS, Google Cloud, Oracle Cloud, DigitalOcean and Linode. Tor: the Tor Project's exit list, refreshed hourly.

Right now: 98,644 disposable domains and 21,665 ranges.