Use case
AI token fraud: stop free credits being farmed and resold
AI products give away tokens and credits that cost real money to serve. Farmers create accounts in bulk, run them through proxies and resell the output. FingerPrint Checker identifies the device behind each sign-up and request, and tags the event with signals about the network and the browser, so you can see the farm and not only the accounts.
The threat
Free credits attract scripted account creation from hosting networks and rotating proxies. Once an account has credits, its key is shared or resold, and one device can drive many accounts in a short time.
What the signals show
- Datacenter, proxy, Tor and blocklist: sign-ups that come from networks real users rarely use.
- Bot, tampering and anti-detect browser: automated or masked sign-ups.
- AI agents: sign-ups and requests from AI crawlers and agents are named when we recognise them, so you can allow the ones you want and refuse the rest.
- Virtual machine: many fresh environments used to open accounts.
- Velocity: one device that appears under many linked IDs or from many IPs in a short time.
How to add it
Ask for an eligibility decision before you grant the free credits, so one device and one household get one grant. Then read the signals of sign-up and key-creation events and apply your own limits: lower quotas for datacenter traffic, a human check for new devices, or a review queue for accounts that share a device.
AI crawlers and agents
Named AI crawlers, AI assistants and agents are marked good or bad bot in each event. Allow the ones you want and refuse the rest by name or category.
Set a lower quota for risky sign-ups
// Backend, after the decision allowed the sign-up and you read its event
const s = event.signals; // null for older events
const farmish = s?.ip.datacenter === true || s?.proxy.result === true || s?.bot.result === 'bad' || s?.virtualMachine === true;
const freeTokens = farmish ? 0 : 100_000; // your numbers, your rules
await grantCredits(session.userId, freeTokens);Frequently asked questions
Does it stop shared API keys?
It shows when one key is used from many devices or networks in a short time, through velocity and the visitor ID. What you do about it is your policy.
Will developers on cloud servers be affected?
Their requests can look like datacenter traffic, because they are. Apply datacenter rules to sign-ups and free grants, not to paid API calls.
Try it on your own sign-up flow
Every new account gets 2,000 free checks. No card required.