Skip to main content
AuthFlame turns a raw email address into a decision by running it through a short pipeline of independent checks, then combining the signals into a single risk score and action.

​
The pipeline

1

Parse and validate syntax

The address is parsed into its local part and domain. Addresses that cannot be parsed are rejected with a 422 error and are not scored.
2

Normalize to a canonical form

Sub-address tags (like +promo) and provider-specific dot variants are stripped to produce normalized.canonical. Use this value to detect duplicate signups across the same underlying inbox.
3

Score the local part

Shannon entropy is calculated over the local part and returned as entropy.score. High entropy suggests an auto-generated address.
4

Inspect the domain

AuthFlame checks the domain against disposable and free-provider lists, resolves MX records live, and evaluates role-account and TLD risk.
5

Summarize into a decision

Signals are combined into summary.risk_score (0–100) and summary.action (ALLOW or BLOCK).

​
Where to call AuthFlame

Call the API server-side, at the moment of account creation, before you persist the user. This gives you:
  • A synchronous decision you can enforce on the signup form.
  • A canonical address to store next to the raw one for duplicate detection.
AuthFlame is designed for signup paths, so you can block on the response in a signup handler. Set a short timeout on the request and decide up front what happens if it expires. See Errors for guidance on handling failures.

​
What to do with the result

For deeper control, branch on summary.risk_score directly and pick your own thresholds.