Score a signup before you allow it
Most fraud APIs hand you signals and leave you to write the scoring. Fidro combines VPN, proxy, Tor, datacenter, reputation and disposable email checks into one score and one decision: allow, challenge or block.
Free for 200 requests a month so you can wire it into a real signup flow and see how it behaves. No card, no expiring trial.
One call, one decision
Most fraud APIs return signals and leave you to write the scoring. Fidro returns the signals and the decision, so a signup flow can act on one field.
Request
curl -X POST https://fidro.io/api/validate \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"email": "user@example.com", "ip": "203.0.113.42"}'Response
{
"risk_score": 82,
"recommendation": "block",
"checks": {
"disposable_email": true,
"invalid_email": false,
"vpn": true,
"proxy": false,
"tor": false,
"bad_isp": false,
"bad_ip": false,
"datacenter": true,
"location_match": false
},
"message": "Disposable email from a datacenter VPN address.",
"location": { "country_code": "US", "city": "Ashburn" },
"test_mode": false
}
recommendation
is allow below 50,
challenge from 50 to 79, and
block at 80 and above.
Every boolean in checks
is the reasoning behind the score, so you can override the thresholds if your risk appetite differs.
IP lookup only
curl https://fidro.io/api/ip/203.0.113.42 \
-H "Authorization: Bearer YOUR_API_KEY"What it detects
vpn
Commercial VPN exit nodes.
proxy
Open and anonymising proxies.
tor
Tor exit nodes.
datacenter
Hosting and cloud ranges, where consumer signups rarely originate.
bad_isp
Networks with a history of abuse.
bad_ip
Addresses seen in prior abuse.
disposable_email
Throwaway and temporary mailbox providers.
invalid_email
Addresses that cannot receive mail.
location_match
Whether the IP country agrees with the country you supplied.
Where the free plan ends
| Requests | 200 per month |
| Rate limit | 60 per minute |
| Credit card | Not required |
| VPN, proxy, Tor, datacenter detection | Included |
| Disposable and invalid email detection | Included |
| IP geolocation lookup | Included |
| Custom blocklists | Starter and above |
| Webhooks | Starter and above |
| Stripe chargeback prevention | Pro and above |
Being straight about the limit: 200 requests a month is enough to evaluate the API, develop against it, and run a small side project. It is not enough for a production signup flow. Better you know now than after you have integrated.
Try it without an account
The same detection runs behind these tools, with no key and no signup, if you want to see the output before writing any code.
Questions
Is the Fidro API really free?
Yes, for 200 requests a month. No credit card is required to create a key and there is no trial that expires into a bill. If you stay under 200 requests a month you can stay on the free plan indefinitely. Above that you need a paid plan, and the API returns a quota error rather than charging you.
What does the free VPN detection API return?
A single POST to /api/validate returns a risk_score from 0 to 100, a recommendation of allow, challenge or block, and a checks object with individual booleans for vpn, proxy, tor, datacenter, bad_isp, bad_ip, disposable_email, invalid_email and location_match. You get the verdict and the reasoning in one response.
Do I need a credit card?
No. Create an account, generate a key from the dashboard, and start calling the API. Card details are only needed if you later choose a paid plan.
What are the rate limits?
Sixty requests per minute on every plan, and 200 requests per month on the free plan. The per-minute limit is about protecting the service; the monthly quota is what separates the plans.
Is 200 requests a month enough?
It is enough to evaluate the API properly, to run it in development, and to cover a low-volume side project. It is not enough for a production signup flow of any size. We would rather tell you that plainly than have you discover it after integrating.
Can I check disposable email addresses for free?
Yes. Pass an email to /api/validate and the checks object returns disposable_email and invalid_email booleans alongside the IP signals. Email and IP are scored in the same call rather than as separate products.
Get a key and make the first call
No card, no sales call. Create an account, copy a key from the dashboard, and the curl above will work.
Get a free API key