Bot and abuse protection

Protect sign-up and sign-in from bots with a CAPTCHA, and refuse passwords that appeared in data breaches.

#CAPTCHA

Create a site key and secret with hCaptcha or Turnstile, then choose the provider and paste the secret in Studio → Authentication → Settings → Bot and abuse protection. From then on sign-up, password and OTP sign-in, password recovery and anonymous sign-in need a CAPTCHA token from the widget on your page:

JavaScript

await stitchdb.auth.signUp({ email, password, options: { captchaToken } })
await stitchdb.auth.signInWithPassword({ email, password, options: { captchaToken } })
await stitchdb.auth.signInWithOtp({ email, options: { captchaToken } })

Requests without a valid token get 400 with error code captcha_failed.

Without any setup, every project also refuses throwaway e-mail addresses and mass sign-ups; see Fake sign-up protection.

#Leaked-password protection

Turn on Prevent use of leaked passwords to refuse passwords found in public data breaches at sign-up and password change (422 weak_password). Only the first characters of the password's SHA-1 hash leave the server (k-anonymity).

#Rate limits

Sign-ups, sign-ins, OTP and verification requests are limited per IP; see Auth limits.