Bot Detection API:
How to Stop Fake Signups in 2026

The Fake Signup Epidemic

Every SaaS product that ships a signup form ships a target. Fake signups aren't an edge case — they're an industry. Bot farms run account creation scripts 24 hours a day, selling verified accounts in bulk to spammers, fraudsters, and competitors who want to harvest your trial features without paying.

The scale in 2026 is hard to overstate. Industry research consistently puts automated bot traffic at 40% of total web requests. For signup flows specifically — because fake accounts have direct monetary value — the proportion is often higher. A consumer fintech product that launched without bot protection saw 60% of its first-week signups flagged as fraudulent after a post-mortem audit. Those accounts had already consumed trial credits, sent spam through the platform's email features, and seeded the user database with garbage that corrupted cohort analytics for months.

The downstream consequences of fake signups extend far beyond the obvious: inflated CAC metrics that mislead fundraising decisions, deliverability damage when fraud accounts trigger spam complaints, compliance exposure when fabricated KYC data gets submitted through onboarding flows, and revenue loss when free-tier abuse by bots displaces real users.

Why Traditional Bot Detection Fails

If you've tried to solve this before, you've probably reached for one of the standard approaches — and found that each one has a ceiling. Here's why:

IP Blocking and Rate Limiting

IP-based blocking is trivially defeated by residential proxy networks, which route requests through real consumer IP addresses with zero bot-associated reputation. A sophisticated bot farm in 2026 can send every request from a unique, clean residential IP. Rate limiting on its own stops volume floods but not low-and-slow campaigns that create five accounts per day from five thousand IPs. Both approaches fail the same way: they assume bots look like bots at the network layer. They don't.

Honeypots

Honeypot fields — hidden form inputs that humans never fill but bots do — work against naive scrapers. Modern bot frameworks skip invisible fields by default. Any bot operator worth their pricing model knows to check for and ignore hidden inputs. Honeypots stopped most automated traffic in 2018. In 2026, they stop only the sloppiest implementations.

Email Verification

Sending a confirmation email before activating an account sounds like a straightforward gate. It is not. Temporary email services (Mailinator, Guerrilla Mail, and dozens of competitors) generate unlimited real-looking addresses that receive and auto-confirm emails. Bot farms have automated workflows that pull the confirmation link from throwaway inboxes in under a second. Email verification adds friction for real users — especially mobile users who have to switch apps to find the confirmation — while adding essentially zero friction for bots.

reCAPTCHA and CAPTCHA Services

This one has the widest gap between perceived effectiveness and actual effectiveness. reCAPTCHA v2 ("I'm not a robot" checkbox) is solved by automated services at accuracy rates above 99% for under $0.001 per solve. reCAPTCHA v3 (invisible, score-based) requires careful tuning and still produces significant false positives on legitimate mobile traffic. Both versions drop conversion rates measurably — reCAPTCHA adds 30%+ abandonment on mobile flows. You're paying a UX cost to stop bots you're not actually stopping.

For a detailed breakdown of how CAPTCHA alternatives compare on UX and effectiveness, see our reCAPTCHA alternatives guide.

CAPTCHA Fatigue: The UX Problem You're Ignoring

Before moving to the solution, it's worth sitting with the CAPTCHA abandonment data, because it's worse than most product teams assume when they're evaluating tradeoffs.

User research on CAPTCHA friction consistently shows:

• 30–40% abandonment on signup flows when image-based CAPTCHAs are present, concentrated in mobile users
• 2–3x higher drop-off rate for users with visual impairments (image CAPTCHAs are actively inaccessible)
• Average 32 seconds to solve a multi-image CAPTCHA on mobile vs. under 3 seconds on desktop
• Negative brand signal — users associate CAPTCHAs with untrusted or "cheap" products

You're paying a real, measurable conversion cost for a bot-prevention layer that sophisticated attackers have already bypassed. The math doesn't work even before you factor in the poor bot detection effectiveness.

Liveness Verification: The Definitive Solution

Liveness verification confirms that a live human being is physically present at the moment of the check. Not "this request pattern looks human." Not "this email address isn't obviously fake." A real person, in real time, confirmed by biometric response to a randomized challenge.

How it works: the user is prompted to perform a specific head movement — turn left, look up, blink — in real time. The system verifies that the response matches the prompt with the timing and motion consistency of genuine human facial muscles. Pre-recorded videos can't respond to an unpredictable prompt. Real-time face swaps introduce latency and motion artifacts. Bots have no face.

The result is a verification method that can't be solved by a bot farm service because it requires physical human presence — a property no software service can commoditize. For a deeper look at why liveness beats passive deepfake detection, see our guide on deepfake detection for businesses.

Liveness verification as a CAPTCHA replacement also wins on UX: the interaction takes under 2 seconds, works on any device with a front camera, requires no cognitive load (you're not deciphering blurry text or selecting all traffic lights), and passes accessibility standards that image-based CAPTCHAs fail.

How to Integrate a Bot Detection API

Let's get concrete. Here's a complete TrueLens integration for a signup flow — from backend session creation to frontend verification to server-side result check. The full flow takes under an hour to wire up.

Step 1: Create a Verification Session (Backend)

Before your signup form is submitted, your backend creates a verification session with the TrueLens API. This returns a session_id and challenge_token that your frontend will use.

// POST /api/signup/start
const createVerificationSession = async (req, res) => {
  const response = await fetch('https://api.truelens.io/v1/sessions', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.TRUELENS_API_KEY}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      type: 'liveness',
      metadata: { ip: req.ip, user_agent: req.headers['user-agent'] }
    })
  });

  const { session_id, challenge_token } = await response.json();

  // Return to frontend — never expose your API key
  res.json({ session_id, challenge_token });
};

Step 2: Run the Liveness Check (Frontend)

Your frontend receives the session tokens and initializes the TrueLens SDK. The SDK handles camera access, the liveness challenge UI, and real-time analysis — you just provide a container element and a callback.

// Add to your <head>
// <script src="https://sdk.truelens.io/v1/truelens.js"></script>

async function startSignupFlow() {
  // 1. Get session tokens from your backend
  const { session_id, challenge_token } = await fetch('/api/signup/start')
    .then(r => r.json());

  // 2. Initialize the liveness check
  const result = await TrueLens.verify({
    session_id,
    challenge_token,
    container: '#verification-container',  // your div
    on_complete: (verificationToken) => {
      // 3. Submit form with the verification token
      submitSignupForm({ email, verification_token: verificationToken });
    }
  });
}

Step 3: Verify the Result (Backend)

When the user completes the liveness check, your frontend receives a verification_token. Your signup handler exchanges this token with the TrueLens API to confirm liveness before creating the account. Never skip this server-side check — a client-side-only verification is trivially bypassed.

// POST /api/signup
const handleSignup = async (req, res) => {
  const { email, password, verification_token } = req.body;

  // Step 1: Verify liveness token with TrueLens
  const verifyRes = await fetch(
    `https://api.truelens.io/v1/sessions/${verification_token}/result`,
    { headers: { 'Authorization': `Bearer ${process.env.TRUELENS_API_KEY}` } }
  );

  const { verified, confidence, liveness_score } = await verifyRes.json();

  if (!verified || liveness_score < 0.95) {
    return res.status(403).json({
      error: 'Verification failed. Please try again.'
    });
  }

  // Step 2: Create the account — confirmed human
  const user = await db.createUser({ email, password });
  res.json({ success: true, user_id: user.id });
};

Step 4: Handle Edge Cases

A production-ready integration needs a few additional considerations:

• Camera unavailable: Handle gracefully with a fallback message and an alternative verification path (email OTP for verified domains, manual review queue for others).
• Liveness score thresholds: A liveness_score of 0.95+ is appropriate for most signups. For higher-risk flows (financial transactions, admin account creation), raise it to 0.99.
• Token expiry: Sessions expire after 10 minutes. If the user sits on your signup page, regenerate the session before they submit.
• Replay prevention: Each verification token is single-use. Your backend should store used tokens and reject duplicates — the API will flag them, but defense in depth is good practice.

TrueLens vs. reCAPTCHA vs. hCaptcha vs. Cloudflare Turnstile

Here's how the major bot prevention approaches compare across the dimensions that matter for a signup flow. For a more detailed breakdown of CAPTCHA alternatives, see the bot detection API comparison guide.

The tradeoff is straightforward: Turnstile and hCaptcha are free and easy, but stop roughly 80% of bots. TrueLens stops 99%+ because liveness verification can't be automated. For a signup flow where fake accounts have downstream costs — support burden, deliverability damage, analytics corruption — the incremental stop rate is almost always worth it.

When to Deploy Bot Detection (and Where)

Liveness verification is not a universal solution for every endpoint — it requires a camera-facing device and adds a step to the user flow. Here's where to deploy it and where to use lighter-weight alternatives:

The Bottom Line

Fake signups are a solved problem — if you use the right tool. IP blocking and rate limiting are table stakes that stop only the laziest attacks. Email verification adds friction for real users while adding none for bots using throwaway inboxes. CAPTCHAs are solved by automated services at $0.001 per challenge and generate 30%+ mobile abandonment for your real users.

Liveness verification is the only approach that doesn't have an evasion path, because it doesn't ask "does this look like a human?" — it asks "is a human physically present right now?" That question can't be answered yes by any automated system. It's a physics constraint, not a classification problem.

TrueLens implements liveness verification as a two-call API: create a session, verify the result. Integration takes under an hour. The liveness check itself takes under two seconds. 50 free verifications to get started — no credit card required. See the full API documentation or check pricing for volume rates.

For a deeper look at the broader security picture, see our guide on account takeover prevention in 2026 — fake signups are often the first step in a longer account abuse chain.