Be generous
to humans.
Stingy to farms.

The fifth account costs what the first did

You give 100 credits with no card, because that is how people try an AI product. The fifth burns the same GPU time.

Your bot check is working

A real browser driven by a real person is not a bot. A fresh email walks through Turnstile and Clerk.

The usual fixes cost honest users

Asking for a card or a phone number turns away people who would have stayed. Heroku ended free plans and blamed fraud and abuse (TechCrunch, 2022).

Browser

<script src="https://nolgard.com/v1/client.js"
  data-site-key="YOUR_SITE_KEY" defer></script>

// In your signup submit handler:
await Nolgard.ready;
const token = await Nolgard.execute({
  action: 'signup'
});
// Send token + email to your backend.

Node · your backend

import { createNolgard } from '@nolgard/node';
const { verify } = createNolgard({
  secret: process.env.NOLGARD_SECRET
});
const r = await verify({ token, action: 'signup',
  account: { email }, remoteIp });
if (!r.success ||
    !['allow', 'limit'].includes(r.decision)) {
  // Reject, step up, or shadow. No credits.
  return;
}
user.credits = r.grant.credits ?? 100;

What you get

• 60 days free. One site, 25,000 new accounts.
• Farm report on day 14.
• 50% off your tier for 12 months when billing ships.

What we ask

• 30 minutes a week.
• One before/after number we may publish.
• At most 10 pilots.

Stripe Radar already does this

Radar scores payments. A trial without a card never reaches it.

We'll just require a card

You lose everyone who tries without one, and you get card testing instead.

We have Clerk and Turnstile

They stop bots. A fifth account in a real browser is not a bot. We link by device, network and mailbox.

Won't this cut real users?

We don't block anyone. We return a number and your backend decides what to do with it. A repeat still gets a smaller trial.

Can't we build it ourselves?

You can. It is a standing race against Camoufox, Patchright and next quarter's build.

What if you go down?

Signups go through. The SDK fails open by design. DPA