Challenge suspicious sign-ups

Bots create fake accounts at scale to abuse free trials, send spam, or inflate sign-up numbers. Challenge suspicious sign-ups makes sign-ups that look automated, or that come through VPNs, Tor, or proxies, pass a challenge before the account is created. Sign-ups that don't match are never challenged.

What it challenges

With Challenge set to Suspicious sign-ups, the default, a sign-up is challenged when either of these is true:

• Clerk's automated-traffic detection flags it as likely coming from a bot.
• It comes through a VPN, Tor, or a residential or data center proxy. iCloud Private Relay and corporate VPNs aren't treated as suspicious.

With Challenge set to All sign-ups, every sign-up is challenged.

Challenge suspicious sign-ups applies to sign-ups only. It never challenges a sign-in.

A sign-up that carries a valid Testing Token isn't challenged, so end-to-end tests that use Testing Tokens keep running.

What happens when a sign-up is challenged

Clerk runs a Cloudflare Turnstile check in the user's browser. Most people pass it without doing anything, and some are asked to complete a CAPTCHA. When the check passes, the sign-up continues. If it doesn't pass, the account isn't created.

• Clerk's prebuilt <SignUp /> component shows the challenge inside the sign-up form.
• In a custom sign-up flow⁠, ClerkJS shows the challenge in a dialog over your page. See Handle sign-up challenges in your custom flow.

Each challenged sign-up appears as a protect.sign_up.challenged event in Application Logs.

Settings

Changing this setting requires the Business plan. On other plans, the protection uses the default.

How it works with other protections

Block sign-ups from suspicious network types blocks the VPN, Tor, and proxy services you select. Sign-ups through services you don't block are still challenged here while Challenge is set to Suspicious sign-ups. Challenge residential proxies also challenges sign-ups from IP addresses that were used as a proxy recently, not only known residential proxies.

Before you enable it

• Make sure challenges can run. See the challenge integration requirements.
• If you use a custom sign-up flow, check it yourself. The Dashboard's requirements check can't tell whether your application uses a custom sign-up flow⁠. If it does, confirm that your flow meets the custom flow requirements before you enable this protection, even if the check passes. When you update from legacy bot sign-up protection, the Dashboard asks you what your application uses.
• Native apps aren't challenged. A sign-up from one of Clerk's native SDKs is let through. See Native API and CAPTCHA.