A new address is not a new customer
Email and phone verification establish access to an inbox or number. A residential IP address describes where the connection exits. None of these alone establishes a new customer, and an anti-detect browser can change the properties used in a fingerprint.
Check the registration session
Add the collector to your signup page. It runs browser checks and connects directly to the Heretic sensor for connection measurements.
TCP options are compared with the claimed operating system. A conflicting Linux signature and macOS claim produces stack.os-contradiction.
Handshake fields are checked against the browser claim, including expected Chromium GREASE values.
An HTTP/2 preface that matches Go while the session claims a browser produces http.h2-stack-contradicts-tls.
The sensor checks whether a required session-specific QUIC attempt arrived.
Round-trip time below the speed-of-light minimum for the claimed timezone produces geo.rtt-below-vacuum.
Checks detect replaced getters, inconsistent plugin lookups, and stable values that differ across browser contexts.
Decide before creating the account
Read the verdict from your backend and verify that it belongs to the pending signup. Inspect its findings and compare available identifiers with existing accounts. A match is conditional evidence of shared inputs; your policy decides whether to reject it or request another check.
An opened session with incomplete required measurements returns refused. If no session opened, no result exists. Neither satisfies
a requirement for a completed probe.
Request a phone challenge
The widget can request a phone ceremony when your policy requires it. The visitor holds the phone level, keeps it steady during a workload, turns it upright and sideways, then confirms with a passkey. Your backend receives the outcome and measured device records.
The signature binds the supplied measurements to the challenge. It does not attest the motion sensor or establish a unique person. An uncontradicted probe likewise reports the result of the checks, rather than proof that a human controls the browser.
Heretic's own signup
Our registration uses the same collector and public APIs. A matching existing-account identifier stops the signup before a challenge. Other repeat, contradicted, refused, or concealed sessions require a challenge. A fresh uncontradicted probe with no concealment can continue directly.
The signup rules guide covers attempt binding, identifier comparisons, and preventing concurrent requests from creating two accounts from one result.