Stop automated account creation, trial farming, and waitlist flooding at the front door. Attackers spin up disposable mailboxes to claim free trials or exhaust waitlist slots; a CAPTCHA plus a signup-abuse monitor makes this expensive and visible.

## What you use

- [Bot protection](/docs/bot-protection) with reCAPTCHA **v3** on `signup` and `waitlist`.
- The Lidar `repeat_signup` monitor (`detection:repeat_signup priorAccounts:>2`), correlated by IP.

## Setup

1. Register a reCAPTCHA **v3** site for the domains that serve your auth pages, including any [custom domain](/docs/custom-domains).
2. In the [console](https://console.authdog.com), open **Authentication > Add-ons > Google reCAPTCHA**, enter the site and secret keys, and select the `signup` and `waitlist` actions.
3. Start with a permissive minimum score (the default `0.5`) and tighten after watching real traffic.
4. Under **Lidar > Monitors**, enable `repeat_signup` and lower `priorAccounts` if your signup volume is low and the default of `2` never fires.

## Verify

- In a dev environment, hit the hosted sign-up page with a script that reuses one IP across several sign-ups: v3 rejects low-score attempts, and `repeat_signup` raises a Signal once `priorAccounts` is exceeded.
- Confirm a real sign-up from a fresh browser still passes; a too-high minimum rejects legitimate users on shared networks and privacy-hardened browsers.
- Check the [Lidar Signals](/docs/console/lidar) view for the finding, then triage or dismiss it so the dedup key (`ai:repeat_signup:<subject>:<windowStart>`) does not keep refreshing.

## Related

- [Stop credential stuffing](/docs/recipes/stop-credential-stuffing): the same front-door control aimed at sign-in.
- [Bot protection](/docs/bot-protection): full reCAPTCHA reference and rollout order.
- [Lidar concepts](/docs/concepts/lidar): how `repeat_signup` correlates and dedups.