How to protect signup credits in an AI app
A playbook for stopping free AI credit abuse. Protect signup credits, free generations and daily allowances in your AI app without slowing down real users.
Signup credits are the best growth tool an AI app has, and the easiest benefit to farm. Every free generation, token or minute of compute is paid for in inference spend the moment someone uses it. When one person collects those credits through ten accounts, you pay ten times for one user who may never buy.
From our early beta
A team woke up to a $6,000 OpenAI bill. Someone had created hundreds of free accounts and used up the complimentary AI credits on every one of them.
Fake users drained one team's shared model provider quota. Their paying customers couldn't use the product until the team raised its budget to cover the abuse.
This playbook shows how to stop free AI credit abuse at the moment it matters: before the credits are granted. It covers signup credits, free generations, daily allowances and referral credits, with the settings we'd recommend for each.
Why AI credits are the most exposed benefit
Three things make AI credits different from a typical free trial:
- They're spent instantly. A trial can be ended. Credits are consumed the moment they land, so any check that runs later is too late.
- They cost real money. Each credit maps to model, GPU or API spend you can't get back.
- They're easy to farm. Collecting credits takes a fresh email and a minute. Scripts make it faster still.
That's why credits belong behind a check that runs before you grant them. For the economics, run your numbers in the real cost of free trial abuse.
The playbook at a glance
| Decision | Recommendation |
|---|---|
| Benefit | One AbuseZero benefit per kind of credit grant: signup, daily, referral |
| Eligibility | Signup credits once per user; daily credits once per calendar day |
| When to check | Always before granting. Never grant credits first and check later |
| Protection level | Strict for generous packs, Balanced for small ones |
| Identifiers | Email, IP address, device token, and a payment method or phone when you have one |
| Automation | Deny scripted claims and require a bot check on large packs; allow the AI agents you trust |
| History | Import past credit grants so protection starts with everything you know |
| Rollout | Observe first, then protect |
Map your credit grants to benefits
Each kind of grant is its own benefit, with its own eligibility and its own strictness.
- Signup credits are the main target. One benefit, claimable once per user.
- Daily free generations reset every day. Use eligibility of once per calendar day, so a returning user gets their daily allowance and a second account doesn't double it. Check whether the daily allowance costs more than an evaluation before you protect it. The break-even math is in the cost guide. More in setting trial eligibility.
- Referral credits reward both sides of an invite, which makes them a magnet for self-referrals. Protect them strictly, and require a bot check. See how to stop promo code and referral abuse.
Check before you grant
The check goes in the same place your app credits the account. AbuseZero evaluates the claim inside one request and returns allow or deny.
import { abusezero } from "@/lib/abusezero";
export async function grantSignupCredits(
user: { id: string; email: string; emailVerified: boolean },
claimId: string,
ip: string,
deviceToken: string,
) {
const evaluation = await abusezero.evaluate(
{
benefit: "signup_credits",
claim_id: claimId,
subject: { external_id: user.id, email: user.email, email_verified: user.emailVerified },
context: { ip },
identifiers: { device_token: deviceToken },
},
`evaluate-${claimId}`,
);
if ("status" in evaluation || evaluation.result === "deny") {
return { granted: false };
}
await addCredits(user.id, 200);
return { granted: true };
}addCredits stands for your own credit ledger. The same evaluation also returns an AbuseZero Risk Score and a reason your team can review. The full integration, including the device token from the AbuseZero browser SDK, is in add a trial and credit abuse check to your signup flow.
Stop paying for the same user twice
Every repeat credit claim AbuseZero denies is inference spend you keep. Start with Builder, pay as you go, or compare plans.
Turn a denial into a sale
A denied repeat claim isn't a dead end. The person clearly wants your product. Instead of an error, show a neutral message and a clear paid path:
Free credits aren't available for this account. Get started with a starter pack instead.
Keep the message neutral and never explain what was detected. That teaches the next abuser nothing. Give real customers who were denied by mistake a way to reach you, and let them through with an allow list. More on keeping real users safe in multi-accounting detection without blocking real users.
Size your credits to the first moment of value
Protection works best alongside a well-sized offer. Give enough credits to reach the moment your product proves itself: a first great image, a working answer, a finished draft. Don't give enough to live on for a month. A smaller, protected pack converts better than a large pack that's farmed. More design choices in how to prevent free trial abuse.
Let real AI agents in
Some of your best users will reach you through AI agents and browser assistants. If your product is agent-friendly, allow the recognized agents you trust on your credit benefits. They're still checked against your rules and eligibility like anyone else. See AI agents are claiming your free trials.
Roll out in a week
Day 1: create the benefits in observe mode and import your past credit grants.
Days 2 to 5: watch. Every claim is still granted. Review what AbuseZero would have denied and why.
Day 6: tune. Pick the protection level per benefit, add allow-list entries for partners or internal accounts, and replay the changes against your recent traffic. See test changes safely.
Day 7: protect. Switch the benefits to protect. Your code doesn't change.
Frequently asked questions
How do I stop users abusing free AI credits?
Evaluate every credit claim before you grant it, because credits are consumed instantly. AbuseZero checks the claim against your full claim history and returns allow or deny, so repeat claims through new accounts can be stopped before any inference is spent.
Can I grant credits first and check in the background?
Not for credits. Background evaluation suits benefits you can take back in full, such as trial days. Credits can be spent before a background check finishes.
Should I require a credit card for free AI credits?
A card requirement cuts abuse and sign-ups at the same time. Checking each claim lets you keep credits card-free for real users while stopping repeat claims.
How do I protect daily free generations?
Make them their own benefit with an eligibility of once per calendar day. Each day's claim is evaluated, so one person can't multiply the daily allowance with extra accounts.
What about referral credit abuse?
Treat referral credits as a separate, strictly protected benefit with a bot check required. Self-referrals through new accounts are one of the most common forms of credit farming.
Protect your AI credits
Start with Builder
Pay as you go. Protect your signup credits today.
See pricing
Builder, Pro, Scale and Enterprise.
Talk to us about Enterprise
High-volume AI apps and custom terms.
Keep reading
- The real cost of free trial abuse for SaaS and AI apps
- AI agents are claiming your free trials. Let the right ones in.
- How to stop free tier abuse on an API product
- Add a trial and credit abuse check to your signup flow
- How to stop promo code and referral abuse in SaaS
- Vibe coded your SaaS? Don't wake up to a $6,000 bill