Block account takeovers before they happen

Catch bots, brute force, impossible travel, and other attacks on your users' credentials, since Auth Guard scores dozens of signals on every login, signup, and MFA challenge. Each tenant can choose whether a detection blocks the request, challenges the user, or logs the event.

Get early accessRead documentation

Protect authentication flows from credential attacks

Auth Guard applies its full set of detectors to each login, signup, and MFA challenge, including the detectors for brute force, bot traffic, impossible travel, and MFA prompt bombing. When a detector matches, Guard blocks the request, asks the user for an extra verification step, or records the event for review, depending on the action that you set.

The signals that each Guard detector checks

Bot detection

Guard checks the User-Agent and the order of the headers on each request, along with how soon after the page loads the form arrives, since automated scripts, headless browsers, and credential stuffing tools can submit a form within milliseconds. You set the minimum submission time and the action that Guard takes on a request that arrives sooner.

Brute force protection

Guard counts the failed logins from each device until a successful login resets the count. You set how many failures Guard allows within a time window, how long a lockout lasts, and whether Guard logs, challenges, or blocks the next login.

Impossible travel

Guard compares the location of each login with the user's previous login and flags the new login when the speed between the two is faster than any traveler can move. For example, Guard flags a login from Tokyo that comes 30 minutes after a login from New York.

Signup abuse prevention

Guard counts the signups from each email address to stop one person from collecting repeated free trials. When someone signs up with the same address a third time, Guard applies the action that you set for signup abuse.

Dormant account reactivation

Guard raises an alert when someone signs in to an account after 60 or more days of inactivity, since an attacker with stolen credentials can be behind that sign-in.

New device detection

Guard records each user's known devices and notifies or challenges the user when a sign-in comes from a new one. After that sign-in, Guard trusts the device for the period that you configure.

Disposable email blocking

Guard blocks signups from thousands of known disposable email domains. To adjust that list, add your own domains to the block list or the allow list.

Region restrictions

Guard finds the country of each login from its IP address, then blocks or challenges the login when that country is on your block list or outside your allow list.

Anonymous network detection

Guard flags logins from VPNs, proxies, Tor exit nodes, and datacenter IP addresses. You choose whether Guard logs, challenges, or blocks those logins.

New country detection

Guard keeps a list of the countries that each user logs in from. When a login comes from a country outside that list, Guard notifies the user and, if you turn the option on, challenges the login.

Verification flooding protection

Guard counts the MFA codes that someone submits for each account during sign-in. Once the count goes over the limit that you set for your time window, Guard logs or blocks each further code, which stops an attacker who tries code after code on one account.

Concurrent session conflict

Guard flags an account with active sessions in two different countries at the same time, since that pattern can mean that someone else is using the user's credentials.

< 50ms
Detection latency

Guard evaluates every detector in parallel

Every request
Full detector set

Guard scores dozens of signals on each login, signup, and MFA challenge

Enterprise
Custom rules

Write rules that combine detector outcomes with request context

Build faster with solutions designed for real-world needs

Block bot sign-ins and see which clients Guard flags

Guard flags a request as a bot when its User-Agent header matches an HTTP library or a browser automation tool, such as curl, python-requests, HeadlessChrome, Selenium, or Puppeteer. When you set the action of bot_detection to block, Guard rejects each flagged sign-in request before Auth checks a password or sends a code.

Impact

The sample sets bot detection to block for the Juniper Lane Outfitters app and requests the 100 most recent Guard events with readEvents. For the events whose detections include bot_detected, the sample counts how many come from each User-Agent, so that your team can see which clients Guard flags most often.

Prompt for a coding agent: Block bot sign-ins, and count the flagged requests by User-Agent.

Conjoin IDE

Select a file to view its contents

Review an account's impossible travel detections before you unlock it

Guard keeps the location of the latest request that it lets through for each account and divides the distance to the next request by the time between the two. Guard raises an impossible travel detection when that speed goes over max_speed_kmh, while it raises a new country detection when a request for the account comes from a country outside the ones that Guard records for that account.

Impact

The sample sets impossible travel to challenge and new country detection to log. It then requests up to 50 Guard events for the account of Rosalind Kwan and prints the time, the IP address, and the detections of each event that includes an impossible travel detection.

Prompt for a coding agent: Challenge impossible travel, and print those detections for this account.

Conjoin IDE

Select a file to view its contents

Block an attacker who tries MFA code after MFA code on one account

Guard counts the MFA codes that someone submits for each account during sign-in, in a fixed window of window_seconds. When you set the action of verification_flooding to block, Guard blocks every further code for an account once the count in the current window goes over max_attempts.

Impact

The sample turns on verification flooding protection for Pelican Point Health, so Guard blocks the sixth and every later MFA code that someone submits for one account within the same 300-second window. It then collects the account IDs from the 100 most recent Guard events whose detections include verification_flooding, so that your support team can contact each user whose account goes over that limit.

Prompt for a coding agent: Block MFA codes after five tries in five minutes, and list the accounts that reach that limit.

Conjoin IDE

Select a file to view its contents

Set an action for each detection and count the outcomes that Guard records

You can set the action of each detection to log, challenge, or block, while disposable email detection accepts log or block. Guard records the outcome of every flagged request in action_taken as logged, challenged, blocked, or allowed, where allowed means that one of your Guard rules with the allow action overrides the detections.

Impact

The sample sets Guard to block impossible travel for Calloway Freight and to challenge requests from the anonymous network addresses that you add to Guard. It then counts the 100 most recent Guard events by action_taken, so that you can see how many flagged requests Guard logs, challenges, blocks, or allows.

Prompt for a coding agent: Block impossible travel, challenge anonymous networks, and count what Guard did with each request.

Conjoin IDE

Select a file to view its contents

Build your next app on Conjoin

Conjoin will open with a free Build tier, while the pricing page already lists the launch prices for Pro and Business. If you tell us what you're building, we'll talk you through early access.

See pricingGet early access