Block sign-ups by country

Some applications can only serve certain countries, because of licensing, regulations, or the markets they operate in. Others see most of their fake sign-ups from a few countries where they have few real users. This protection keeps a list of countries and uses it in one of two ways:

• Blocklist. Sign-ups from the countries on the list are blocked. Everyone else is unaffected.
• Allowlist. Only the countries on the list can sign up. Sign-ups from every other country are blocked.

What it blocks

Clerk determines a sign-up's country from its IP address. A sign-up is blocked when:

• List type is Blocklist, and its country is on the list.
• List type is Allowlist, and its country isn't on the list. Sign-ups whose country can't be determined are blocked too.

This protection applies to sign-ups only. It never affects a sign-in, so existing users can keep signing in from any country.

What happens when a sign-up is blocked

The account isn't created, and the user sees a message that they can't sign up. See What blocked users see.

Each blocked sign-up appears as a protect.sign_up.blocked event in Application Logs.

Settings

How it works with other protections

Block sign-ups from suspicious network types blocks the VPN, Tor, and proxy services you select, which people can use to appear to be in another country. Turn it on too to make this protection harder to get around.

Before you enable it

• Country is based on the IP address. Someone using a VPN appears to be in the country of the VPN server, so a determined person can get around this protection. See How it works with other protections.
• With an allowlist, list every country you serve. Sign-ups from any country you leave out are blocked, as are sign-ups whose country can't be determined.
• Existing users aren't affected. This protection doesn't stop users who already have an account from signing in from a blocked country. If you're required to restrict access for legal reasons, this protection alone isn't enough.
• Check that Protect sees your visitors' IP addresses. See If you proxy Clerk's Frontend API.