Get started

Quickstart

Portreeve is an abuse firewall for SaaS signups, trials, checkouts, and logins. You call it inline at five moments — signup, trial_start, trial_convert, checkout_attempt, login — and enforce the verdict that comes back:

1{
2  "id": "evt_01J8Z3K9",
3  "verdict": "review",
4  "reasons": [{ "code": "identity_cluster", "detail": { "linked_accounts": 4 } }],
5  "policy_version": "2026-08-22.0"
6}

allow and block are immediate. review never blocks the user — it means “proceed, we’re looking at it”, and a later denial reaches you via webhook. Read Handling verdicts before going live — wiring the review flow correctly is the part of the integration that matters most.

Get set up in five minutes

1

Create an account

Sign up at dashboard.portreeve.com — Google or email. The free tier needs no card.

2

Create your test keys

In Settings → API keys, create a secret test key (sk_test_…). You’ll add a publishable key (pk_test_…) later, for device fingerprinting.

3

Fire your first verdict

Works from any stack, before you install anything:

$curl https://api.portreeve.com/v1/verdict \
>  -H "authorization: Bearer sk_test_YOUR_KEY" \
>  -H "content-type: application/json" \
>  -d '{
>    "event_type": "signup",
>    "external_user_id": "usr_demo_1",
>    "email": "jane@example.com",
>    "ip": "203.0.113.7"
>  }'

You’ll get back a verdict in under 100 ms:

1{ "id": "evt_…", "verdict": "allow", "reasons": [], "policy_version": "…" }
4

See it in the dashboard

Open Events (the mode toggle defaults to Test) and your signup is there, with its verdict and reasons.

The path from here

The rest of the integration, in order:

  1. Keys and your first verdict in code — install the SDK, screen a real signup route.
  2. What to send for each event type — canonical payloads and the fields that matter.
  3. Device fingerprinting — the browser snippet. Not optional if you take payments.
  4. Handling verdicts — the review flow, webhooks, checkout patterns.
  5. Test mode and feedback — verify end to end, swap to live keys, report outcomes back.

Not on Node? The whole API is reachable over plain REST.