SaaS & free trials
Free trials are the cheapest thing on the internet to abuse. Stop trial farming without adding friction for real buyers.
What the problem actually is
A free trial is an unpaid product with a credit-card-free door. The economics attract two distinct abusers: people cycling disposable emails to extend a trial forever, and bots creating accounts in bulk to consume compute, send spam from your domain, or poison your analytics and activation metrics. Both look like signups. Neither is caught by email confirmation, because confirming a mailinator address is trivial.
Signals that carry the weight here
The single strongest trial-abuse signal. Someone using a throwaway address for a business tool is almost never evaluating it for a business.
Catches the same machine returning under a new email and a new IP — which is exactly what trial cycling looks like.
Real evaluators browse from an office or home. A signup from AWS is automation.
Where to start
strictness=1 (balanced) — Balanced. Block disposable outright, send datacenter and VPN signups to email verification rather than rejecting — plenty of legitimate developers evaluate through a corporate VPN.
A defensible starting point, not a guarantee. Strictness moves the verdict thresholds only; the risk score itself never changes, so you can re-tune without re-scoring anything.
The call
curl -X POST "https://www.layercall.com/v1/score/user" \
-H "X-Api-Key: YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"ip":"$IP","email":"$EMAIL","device_id":"$DEVICE_ID"}'1,000 lookups a month free, no card. Get an API key.
Questions
Will this block developers using a VPN?
Not at the default strictness. A commercial VPN scores 40, which is 'review', not 'block' — it should trigger a verification step, not a rejection. Blocking every VPN is the most common false-positive complaint about fraud tools, and it costs you exactly the technical buyers you want.
What about corporate networks that look like datacenters?
Datacenter alone scores 30 and stays in allow, deliberately. It is a supporting signal, not a verdict — it only pushes past the threshold when it stacks with something else, like a disposable address or a device already seen on a dozen accounts.