Use case · Signup integrity

One device, one account, actually enforced.

Emails, phone numbers, and proxies all rotate for cents. The device is the one signup input attackers can't trivially rotate — if it proves itself with hardware-backed evidence, not a fingerprint script they control.

The problem

Fingerprinting catches the lazy bots. Nobody else.

The same computer signs up as 1,000 different people, and your growth numbers, quotas, and abuse limits are all quietly counting fakes. The cost lands as inflated metrics you can't trust, free-tier budgets drained by accounts that were never real, and abuse thresholds tripped by a single machine wearing a thousand faces.

Modern signup farms run on cheap inputs: SIM banks ($0.01/phone), disposable email domains ($0/email), residential proxies (~$3/GB). Fingerprinting catches anyone on stock Chrome and stock Windows, and misses anyone using GoLogin, Multilogin, AdsPower, or Kameleo, which synthesize plausible "fresh device" profiles for any number of fresh signups.

The thing that doesn't scale is a physical computer. Hardware is the only signup input that costs the attacker more per try than the marginal account is worth.

The fix

Bind the signup to a real, distinct machine.

Every signup carries a device ID proven by the security chip built into virtually every modern laptop and phone.
The ID is stable per customer (same device, same ID, forever), so 'one account per device' becomes a simple database check, not a CAPTCHA.
The ID is anonymous: a one-way scramble of the device's hardware key, unique to you and never the key itself. Nothing links a device across companies, and there's no secret to steal.
You see what kind of device it is (a real physical chip; a firmware chip, meaning a security chip built into the processor itself; a cloud server; or a software emulator), so you decide which ones count as real signups.

The integration

It drops into your signup handler.

Two calls to Root Herald bracket your normal signup: mint a challenge, then verify. A device your policy rejects, like a cloud server or a software emulator, never gets past the verify. What you add is the verify call and one device-ID lookup.

server-side signup handler · @rootherald/nodets

import { RootHerald } from "@rootherald/node";

const rh = new RootHerald({ secretKey: process.env.RH_SECRET_KEY }); // rh_sk_…

app.post("/api/signup", async (req, res) => {
  const { email, password, challengeId, evidence } = req.body;

  // Earlier: rh.issueChallenge() -> send the one-time challenge code to your app,
  // which collects the sealed hardware proof and posts it back here. Verify server-to-server:
  const verdict = await rh.verify(evidence, {
    challengeId,
    policy: "rootherald:builtin:strict-hardware",  // our "real physical chips only" rule
  });
  if (verdict.device.verdict !== "pass") {
    return res.status(403).json({ error: "device_check_failed" });
  }

  // Per-tenant device id — stable across this user's future logins, anonymous otherwise.
  if (await usersRepo.deviceAlreadyRegistered(verdict.device.ueid)) {
    return res.status(409).json({ error: "already_signed_up_from_this_device" });
  }

  const user = await usersRepo.create({ email, password, deviceId: verdict.device.ueid });
  res.json({ ok: true, userId: user.id });
});

This is the server half. Before it runs, the user's device collects the sealed proof through the Root Herald browser extension or native SDK, both in preview today. The browser and native guides walk the full client-and-server flow.

The numbers

The break-even runs against the attacker.

A consumer signup is worth about $2–$15 to a spam or arbitrage operator. A used office desktop with a real security chip retails for $50–$120: a break-even of 3–30 fake signups per physical machine. And only if the attacker keeps a wholly fresh operating system and browser per signup without reusing the same chip.

They can't. Our device ID is tied to the security chip, not the operating system install, so reinstalling Windows doesn't reset it. That pushes the attacker toward buying real machines in bulk (expensive and detectable) or toward software emulators (rejected outright by the default policy).

Enforce one device, one account, structurally.

No CAPTCHA, no SMS, no 'prove you're human' modal. Free up to 10K device checks a month.

Start free Read the quickstart →