Block fake and disposable signups with one API call

Why fake signups cost you

The whole idea in four lines

Run it on your server where the account is created. action is do_not_send only for addresses that can't receive mail or are throwaway. The recipes wrap this with a timeout, dry-run mode and fail-open handling.

const r = await fetch("https://simpleverifier.com/api/v1/verify", { method: "POST",
  headers: { Authorization: `Bearer ${process.env.SIMPLEVERIFIER_KEY}`, "Content-Type": "application/json" },
  body: JSON.stringify({ email }) }).then((res) => res.json());
if (r.action === "do_not_send") throw new Error("Please use a real, permanent email address.");

What to block and what to warn on

Branch on the decision fields, never on the reason sentence: action, reason_code and likely_invented have a fixed shape and are documented here.

Drop-in recipes

Each one is complete, copy-paste code against the public API, with the timeout set under the platform's own limit.

• SupabaseRuns before the user exists. A blocked address never becomes an auth.users row.
• ClerkThe webhook runs just after Clerk creates the user, so a blocked account exists for a moment and is then deleted. A custom sign-up form (step 4) checks before the account is created.
• FirebaseRuns before the user is saved. A thrown HttpsError stops the account being created.
• Next.jsRuns in your own server code before the account is created, so you choose exactly what happens.
• ExpressRuns before your route handler creates the account.
• Cloudflare WorkersRuns in front of your origin, so blocked sign-ups never reach your app or database.
• Zapier and n8nRuns after the form is submitted, before the contact reaches your list or CRM. It can't show an error on the form itself.
• Webflow and Framer formsRuns after the visitor submits. It keeps fakes out of your list but can't show an error on the hosted form.

Pricing

Signup checks use the API included in the existing plans. Each address you check is one call. Calls past the included ones are billed per 1,000 on monthly billing.

Every key allows 120 calls a minute. Full plan details are on the pricing page.

Common questions

Will this block real people?

Block only what the table says: disposable, invalid and misspelled addresses. Role inboxes, catch-all domains and invented-looking addresses get a warn flag instead, and anything the check couldn't finish is allowed. Start with dry-run mode, which logs what would be blocked and blocks nothing.

How fast is a check?

Format, disposable, typo and no-mail-server answers come back quickly. A live mailbox check can take several seconds when a mail server is slow, so every recipe sets a timeout under its platform's limit and lets the signup through when it runs out.

Can I call the API from the browser?

No. Keep the key on your server, in your auth hook or in a Worker. Anyone who can read the key from your page can use your plan.

Is there an npm package?

Not yet. Client drafts for Node.js and other languages can be downloaded, but none is on npm. The recipes use plain fetch, so there is nothing to install. See the SDKs page.

Which plan do I need?

Any plan with API access: Pro, Business or Agency. Each signup you check is one API call. Starter and Growth cover CSV uploads only.