Express.js integration

Block disposable emails in Express.js

You're running an Express app and fake signups keep getting through. Drop in one middleware function and Fidro checks every email and IP on the routes you choose.

How it works

Write one middleware function that sends the email and IP to Fidro with fetch, attach the answer to the request, and put it in front of the routes that matter. Fidro checks the address, the network and what it has already seen from them, then answers allow, challenge or block. No SDK needed.

One fake signup can look perfectly normal. Five from the same IP in an hour don't. Send event and user_id with each call and Fidro remembers, so it catches the pattern as well as the person. You get a score from 0 to 100 and one answer: allow, challenge or block.

1. Install what you need

# Node 18+ has fetch built in. On older versions:
npm install node-fetch

You'll also need an API key. Sign up free and you'll have one in a minute, no card needed.

2. Check every signup

Send the email and IP to POST /api/validate. Fidro checks for disposable domains, missing mail servers, VPNs, proxies and Tor, and answers allow, challenge or block. Let the allows straight in, ask the challenges to confirm their email, and turn the blocks away.

// middleware/fidro.js
const FIDRO_API_KEY = process.env.FIDRO_API_KEY;

function clientIp(req) {
  const forwarded = req.headers["x-forwarded-for"];
  return forwarded ? forwarded.split(",")[0].trim() : req.socket.remoteAddress;
}

async function fidroCheck(req, res, next) {
  const email = req.body.email;
  if (!email) return next();

  try {
    const response = await fetch("https://fidro.io/api/validate", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${FIDRO_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ email, ip: clientIp(req), event: "signup" }),
    });

    if (!response.ok) return next(); // Fail open on API errors

    req.fidro = await response.json();

    if (req.fidro.recommendation === "block") {
      return res.status(403).json({ error: "This signup has been flagged as high risk" });
    }

    next();
  } catch (err) {
    console.error("Fidro error:", err.message);
    next(); // Fail open
  }
}

// ----- app.js -----
const express = require("express");
const app = express();

app.use(express.json());

app.post("/api/signup", fidroCheck, (req, res) => {
  // req.fidro.recommendation is "allow" or "challenge" here
  // Create the account...
  res.json({ recommendation: req.fidro?.recommendation });
});

app.listen(3000);

3. Look up an IP

Just want to know where a request came from? GET /api/ip/{ip} returns the country, city, ISP and network, without scoring. The VPN, proxy and Tor flags come from /api/validate, under data.checks.

const FIDRO_API_KEY = process.env.FIDRO_API_KEY;

function clientIp(req) {
  const forwarded = req.headers["x-forwarded-for"];
  return forwarded ? forwarded.split(",")[0].trim() : req.socket.remoteAddress;
}

async function fidroIpLookup(req, res, next) {
  try {
    const response = await fetch(`https://fidro.io/api/ip/${clientIp(req)}`, {
      headers: { Authorization: `Bearer ${FIDRO_API_KEY}` },
    });

    if (response.ok) {
      req.fidroLocation = (await response.json()).location;
    }
  } catch (err) {
    console.error("Fidro error:", err.message);
  }
  next();
}

// Usage
app.get("/api/check-ip", fidroIpLookup, (req, res) => {
  res.json({
    country: req.fidroLocation?.country_name,
    isp: req.fidroLocation?.isp,
  });
});

Want to see real results first? Try any address in the free IP checker.

Next steps

The API reference has every field. The free checker shows you real results. And if you're weighing up alternatives, the comparisons are honest about where others fit.

API Documentation Free email checker Compare Fidro

Frequently Asked Questions

How do I add fraud detection to Express.js?

Write a middleware that sends the user's email and IP to https://fidro.io/api/validate and attaches the result to the request. Fidro returns a risk score from 0 to 100 and one recommendation: allow, challenge or block. It takes a few minutes and drops in front of any route.

Does Fidro have an Express.js SDK?

You don't need one. Fidro is a plain REST API, so Node's built-in fetch (Node 18 and later) or node-fetch is all it takes, wrapped in a small middleware.

Is Fidro free to use with Express.js?

Yes. The free plan covers 200 validations a month with no credit card, and it works in any Express app, whether it's an API, a web app or a microservice.

What should I do when Fidro says challenge?

Ask for something a real person will happily do and a script won't: confirm the email address, solve a CAPTCHA, or wait for a quick manual review. Save outright blocks for the clear cases.

Start catching bad signups in the next 5 minutes

Create your account, grab your API key, and send your first request. Free plan with 200 validations/month. No credit card. Cancel anytime.

Start for free Read the docs