Signup risk checks with Abstract API

A Next.js signup form that checks every new account with Abstract before creating it. It sends the email address, phone number and IP address to three Abstract products, then allows, flags or blocks the signup with rules you edit in one file.

The button installs the Abstract API integration. Sign in or create a free Abstract account in its window, pick the products, and your keys are added to the new project as environment variables.

What it checks

Product	Env var	Signals the rules use
Email Intelligence	ABSTRACT_EMAIL_INTELLIGENCE_API_KEY	Disposable address, deliverability, address and domain risk, suspicious username
Phone Intelligence	ABSTRACT_PHONE_INTELLIGENCE_API_KEY	Validity, VoIP, disposable number, risk level, abuse
IP Intelligence	ABSTRACT_IP_INTELLIGENCE_API_KEY	Tor, VPN, proxy, hosting provider, abuse, country

The three calls run in parallel from server code, so API keys never reach the browser. A product without a key, or a call that fails, is skipped and the signup still gets a verdict from the others.

Run it locally

npm install
cp .env.example .env.local   # then paste your keys
npm run dev

Get your keys in the Abstract dashboard. The integration stores them in Vercel as Secrets, which can't be read back, so copy them from the dashboard into .env.local.

In next dev the form runs in test mode: it shows an IP address field, because your own requests come from localhost, and a button that fills a risky signup.

Make it yours

• Rules: src/lib/rules.ts decides the verdict. Any block reason blocks the signup, any review reason flags it, and no reason allows it.
• Products: using one or two Abstract products? Remove the others from CHECKS in src/lib/checks.ts. Their form field and their rules go away.
• Account creation: src/lib/create-account.ts is a stub. Call your auth provider there (Clerk, Auth.js, Supabase, ...). Signups with a review verdict reach it too, so you can hold them for review or ask for extra verification.
• Form: src/components/signup-form.tsx and the server action in src/app/actions.ts.

Running a public demo

If you deploy this as a public demo rather than a signup page, protect your quota:

• Set NEXT_PUBLIC_TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY to turn on the Cloudflare Turnstile bot check.
• Add a rate limit rule in the Vercel Firewall and a spend cap on the project.
• ABSTRACT_TEST_MODE=true keeps the IP field and sample button. Never set it on a real signup page: visitors could choose the IP address the check sees.

Learn more

• Abstract documentation
• Next.js Server Actions

License

MIT