Block fake signups in Auth0 (pre-registration Action)

Auth0's Pre User Registration trigger runs before a database-connection user is created, which is exactly where a signup check belongs.

1. Create the Action

In the Auth0 dashboard: Actions → Library → Build Custom, trigger Pre User Registration. Add a secret named VEQEN_API_KEY.

exports.onExecutePreUserRegistration = async (event, api) => {
  let result = null;
  try {
    const response = await fetch("https://veqen-app.com/v1/signup/check", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${event.secrets.VEQEN_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ email: event.user.email, ip: event.request.ip }),
      signal: AbortSignal.timeout(4000),
    });
    if (response.ok) result = await response.json();
  } catch (err) {
    return; // fail open: never block signups because of an outage
  }
  if (!result) return;

  if (result.risk.verdict === "refuse") {
    api.access.deny("veqen_refused", "Please sign up with a permanent email address.");
    return;
  }
  api.user.setAppMetadata("veqen_verdict", result.risk.verdict);
  api.user.setAppMetadata("canonical_email", result.email && result.email.canonical);
};

2. Deploy and attach

Deploy the Action, then drag it into the Pre User Registration flow.

3. Use the stored verdict

The Action saves app_metadata.veqen_verdict. In a Post Login Action or in your app, require email verification before granting trial features when the verdict is review.