Skip to content

Radar

Protect against bots, fraud, and abuse.

Detect, verify, and block harmful behavior in real time. Radar protects your app against automated bots, account abuse, credential theft, and more.

Get startedRead the docs
Radar
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Advanced protection for every user, every time

Allowed, challenged, or blocked — in milliseconds

1

Signals are collected

Every sign-up, sign-in and password reset arrives with device, network and behavioural signals. Nothing extra to instrument — the check rides along with the request you already make.

2

Risk is scored in real time

Radar automatically blocks common threats like credential stuffing and brute force attacks, with flexible settings that can be tailored to your app.

3

You decide what happens next

Allow, challenge or block. Combine Radar's verdict with your own product data through Actions to write the rule only you could write.

Device intelligence

Enhanced identity with device-level intelligence.

Powered by sophisticated device fingerprinting, Radar analyses more than twenty signals to accurately distinguish real users from bad actors and bots.

  • Window features, navigator properties and browser feature support
  • Headless detection and detectable privacy features
  • Screen properties, device model and DOMRect rendering
  • Keyboard layout, timezone, international time and installed fonts
  • WebGL rendering, media format support, CSS support and speech synthesis
Device intelligence
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Actions

From bots to script kiddies, Radar can find it all.

Identify fake account signups, automated traffic, free-tier abuse, and more. For full control, combine Radar's signals with your product data through Actions.

  • Fake account signups caught before they consume a seat
  • Repeat free-tier signups from the same device or network
  • Sign-in bursts that look nothing like your real traffic
  • Your own rules on top of Radar's verdict, evaluated inline
Actions
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Seamless protection

From start to secured.

Nine classes of abuse, covered by one integration. Turn each one on per environment, per organisation, or leave the defaults alone.

Bot blockingProtect against bots and scripted attacks.
Unknown devicesChallenge logins from unknown devices.
Brute force attacksPrevent attacks on the same account from multiple devices.
Stale accountsGuard dormant accounts from compromise.
Free trial abuseDetect patterns of repeat sign-ups and suspicious usage.
Impossible travelDetect when users sign in from distant locations too quickly.
SMS challengesChallenge users with a text to stop bots and fraud.
Geo blockingBlock sign-ins by country and manage regional access.
Credential stuffingStop attacks on your user base using breached credentials.

Developer experience

Score a request before it reaches your app.

One call, one verdict. Radar returns the decision and the signals behind it, so you can log it, override it, or explain it later.

1// Evaluate a sign-in attempt before creating a session
2import Paycux from '@paycux/node';
3 
4const paycux = new Paycux('sk_example_123456789');
5 
6const verdict = await paycux.radar.evaluate({
7  event: 'sign_in',
8  email: 'alan@foo-corp.example',
9  ipAddress: req.ip,
10  deviceToken: req.body.paycux_device_token,
11  organizationId: 'org_01EHZNVPK3SFK441A1RGBFSHRT',
12});
13 
14if (verdict.action === 'block') return res.status(403).end();
15if (verdict.action === 'challenge') return sendSmsChallenge(verdict);

Transparent pricing

Priced by check

A check is one evaluated sign-up, sign-in or password reset. Detect and stop bots, fraud and abuse in real time, with adaptive protection that scales with your traffic rather than your headcount.

See full pricingTalk to an expert
First 1,000 checksFree
Per 50k checks$100 / mo
Uptime SLAEnterprise (planned)
Premium supportSupport plans
Custom enterprise plansContact sales

Questions

Frequently asked

Do I need to add a script to my frontend?

Only if you want device-level signals. The server-side check works on its own; dropping in the device script adds fingerprinting so Radar can tell a returning browser from a fresh one.

What is the difference between block and challenge?

Block stops the request outright and returns a verdict you can log. Challenge hands the user a step-up — an SMS code or an additional factor — and lets them through once they pass.

Can I tune the protections per customer?

Yes. Every protection can be enabled per environment and per organisation, so a strict enterprise tenant and a permissive free tier can live in the same app.

Does Radar work if I do not use Paycux for authentication?

It does. Radar is a standalone API — call it from whatever authentication layer you already run, and act on the verdict yourself.

How does Radar handle personal data?

Signals are processed to produce a verdict, and the evaluation record keeps only what is needed to explain it. Retention is configurable, and the design is built around GDPR and KVKK obligations.

Keep exploring

The rest of the platform

User ManagementComplete auth and user management platform
Enterprise SSOUnified SSO for any identity provider
AuthKitCustomisable UI for every authentication type
Directory SyncUser lifecycle from corporate directories
Role-Based Access ControlPowerful and flexible permissions for your users
MCP AuthSecure auth for MCP servers

Designed to safeguard your growth.

Jump into the docs and get protected in minutes — no traffic replay, no training period, no waiting on a model to warm up.

Get startedTalk to an expert