Skip to main content
AuthFlame turns a raw email address into a decision by running it through a short pipeline of independent checks, then combining the signals into a single risk score and action.

​
The pipeline

1

Parse and validate syntax

The address is parsed into its local part and domain. Malformed addresses fail fast with syntax.valid_format: false.
2

Normalize to a canonical form

Sub-address tags (like +promo) and provider-specific dot variants are stripped to produce normalized.canonical. Use this value to detect duplicate signups across the same underlying inbox.
3

Score the local part

Shannon entropy is calculated over the local part. High entropy suggests an auto-generated address; the entropy.suspicious flag summarizes the result.
4

Inspect the domain

AuthFlame checks the domain against disposable and free-provider lists, resolves MX records live, and evaluates catch-all, role-account, and TLD risk.
5

Summarize into a decision

Signals are combined into summary.risk_score (0–100), summary.risk_level, and summary.action (ALLOW or BLOCK).

​
Where to call AuthFlame

Call the API server-side, at the moment of account creation, before you persist the user. This gives you:
  • A synchronous decision you can enforce on the signup form.
  • A canonical address to store next to the raw one for duplicate detection.
AuthFlame is designed for latency-sensitive paths. Median global latency is under 25 ms, so you can block on the response in a signup handler without noticeable friction.

​
What to do with the result

For deeper control, branch on summary.risk_score directly and pick your own thresholds.