1,000 free checks every month · no card

Someone else signed in. Your user hears first.

When a sign-in comes from a new device or looks like account takeover, LoginLlama emails your user a “Was this you?” alert in your brand. Your app gets a 0–10 risk score too, so it can block or step up to MFA. One API call.

Integrate in one prompt, or drop in the SDK. 1,000 free checks to start.

POST /api/v1/login/check

identity_key[email protected]

ip_address197.210.8.24

locationLagos, 12 min after Austin

status: fail

7/10

ip_address_not_used_beforenew_login_locationimpossible_travel_detected

One call, before you finalize the login. Sub-500ms. Fails open.

33,000+: logins scored
260,000+: known bad IPs and ranges checked
Since 2023: protecting real login flows

Most breaches start with a valid password in the wrong hands.

Credential stuffing is automated, cheap, and relentless. Logs and 2FA tell you after. LoginLlama tells you at the moment of login, while you can still do something about it.

See how a login gets scored

Three sign-ins, what LoginLlama knew about each person, and what the API sent back. These are examples, scored by the same code that scores yours.

Example

A new phone in a new country

Signs in with Chrome on a Mac from Manchester, UK, on Virgin Media. Last sign-in three days ago.

Your app sends

identity_key: [email protected]
ip_address: 179.228.33.24
user_agent: Mozilla/5.0 (Linux; Android 14; SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Mobile Safari/537.36

LoginLlama looks up

São Paulo, Brazil on Vivo (AS26599)

The API returns

status: pass5/10

ip_address_not_used_before
new_login_location
device_fingerprint_not_used_before

Your user gets a “Was this you?” email.

Example

Impossible travel

Signed in 12 minutes ago with Chrome on a Mac from Austin, Texas, on Spectrum.

Your app sends

identity_key: [email protected]
ip_address: 197.210.8.24
user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

LoginLlama looks up

Lagos, Nigeria on MTN Nigeria (AS29465)

The API returns

status: fail7/10

ip_address_not_used_before
new_login_location
impossible_travel_detected

Your user gets a “Was this you?” email.

Example

Password spraying from a cloud server

Signs in with Chrome on a Mac from Leicester, UK, on Virgin Media.

In the last ten minutes this address failed to sign in to 14 of your accounts.

Your app sends

identity_key: [email protected]
ip_address: 188.166.10.24
user_agent: python-requests/2.32.3

LoginLlama looks up

Amsterdam, Netherlands on DigitalOcean (AS14061)

The API returns

status: fail10/10

known_proxy
ip_address_not_used_before
new_login_location
device_fingerprint_not_used_before
ip_password_spraying

Your user gets a “Was this you?” email.

Three steps to protect every login

Use the SDK for your language, or a plugin for your auth library. You keep control of the decision.

Call one endpoint

After your auth check passes, send the login to LoginLlama with the user, IP, and user agent.

Get a risk score

Back comes a 0–10 score and the exact codes that triggered it.

Decide

Allow, step up to MFA, or block — on your own thresholds. You stay in control.

Plugins for your auth library

Better Auth plugin
Clerk integration
Auth.js integration
WordPress pluginComing soon
Auth0 ActionComing soon

$ npm install loginllamanpm

import { LoginLlama } from 'loginllama';

const loginllama = new LoginLlama({
  apiKey: process.env.LOGINLLAMA_API_KEY
});

// Use middleware for automatic IP/User-Agent detection
app.use(loginllama.middleware());

// Pre + Post Auth Pattern - Most complete protection
app.post('/login', async (req, res) => {
  const { email, password } = req.body;

  try {
    // Step 1: Pre-auth check (before verifying credentials)
    const preCheck = await loginllama.check(email, {
      authenticationOutcome: 'pending'  // Mark as pre-auth check
    });

    // Block high-risk attempts before authentication
    if (preCheck.risk_score > 7) {
      return res.status(403).json({ error: 'Login blocked' });
    }

    // Step 2: Authenticate with your system
    const authResult = await authenticate(email, password);

    // Step 3: Report outcome to LoginLlama
    if (authResult.success) {
      await loginllama.reportSuccess(authResult.user.id);
      return res.json({ success: true });
    } else {
      // Report failed auth - helps detect brute force attacks
      await loginllama.reportFailure(email);
      return res.status(401).json({ error: 'Invalid credentials' });
    }
  } catch (error) {
    console.error('LoginLlama error:', error);
    return res.json({ success: true }); // Fail open on errors
  }
});

The fastest way to try it

Install it in one prompt

Don't want to read docs? Hand the prompt to your coding agent. It installs the SDK, wires the risk check into your login, and asks you for an API key — so you can be testing in minutes, not an afternoon.

Detects your stack and installs the right SDK
Adds the check after auth, fails open by design
Prefer the manual path? The SDKs are one import away

Paste into your agent

Integrate LoginLlama (suspicious login detection) into this project.

1. Detect the language/framework and install the official SDK:
- Better Auth (any framework): npm install better-auth-loginllama,
then add loginLlama() to plugins
- Clerk: npm install clerk-loginllama,
then export POST = loginLlamaWebhook()
from a session.created webhook route
- Auth.js (NextAuth) Credentials: npm install authjs-loginllama,
then wrap authorize in withLoginLlama()
- Node.js / Next.js / Express: npm install loginllama
- Python / Django / Flask: pip install loginllama
- PHP / Laravel: composer require joshghent/loginllama
2. Read the live API reference and examples from https://loginllama.app/docs (the machine-readable
summary is at https://loginllama.app/llms.txt).
3. Add a LOGINLLAMA_API_KEY environment variable. If I don't have a key yet, tell
me to grab one at https://loginllama.app/account/api (sign up free at https://loginllama.app/signup) and paste it.
Never hard-code the key — load it from the environment.
4. After my auth step succeeds, call LoginLlama with the user's identity_key,
email, IP address and user agent. Branch on the result:
- risk_score > 5 -> require MFA / extra verification or block
- otherwise -> allow the login
Always FAIL OPEN: if LoginLlama errors or times out, log it and let the user in.
5. Add a short comment linking to https://loginllama.app/docs and show me how to test it locally.

Works in Claude Code Cursor Codex

What goes into the score

Many signals, one number. Each risk code tells you exactly why a login looked off.

Impossible travel

Two logins too far apart to be the same person. Austin at 9:00, Lagos at 9:12.

Tor & VPN exit nodes

Traffic hiding behind anonymizing networks that legitimate users rarely need.

New device & browser

A device fingerprint this account has never used before.

New location

A first-time city or country for this specific user.

Bots & automation

Headless browsers and scripted traffic behind credential-stuffing runs.

Sub-500ms, fail-open

Fast enough to sit in the login path, and it never locks out real users if we are down.

New · MCP

Just ask your login data

Connect LoginLlama's MCP server to your agent and ask in plain language — “what's my average login risk score for Chrome?” or “show me the riskiest logins this week.” Read-only, scoped to your team.

An alert for your user, a score for your app

Your user gets a “Was this you?” email the moment a sign-in looks wrong, so they can reset their password before any damage is done. Your app gets a score it can act on before the session is handed over.

Building it in-house

—6–12 months of engineering
—Threat lists, geo data, device fingerprints to maintain
—A distraction from your actual product
—Still blind to patterns across other apps

LoginLlama

Live in minutes — one prompt or one import
“Was this you?” emails in your brand, on by default
Risk score + codes you can branch on
Cross-app threat signals, maintained for you
From $0/month, fails open by design

Simple, transparent pricing

Start free. Scale as you grow. No credit card to begin.

Stop account takeovers without building a fraud team.

Get 1,000 free login checks to start. No credit card required.

Launch in minutes

Block risky logins instantly

Scale as attacks grow

Starter

$19/ month

No credit card required

Professional

$49/ month

No credit card required

Enterprise

$199/ month

No credit card required

Compare plans

Feature	Starter	Professional	Enterprise
Quotas
Login Checks	10,000	50,000	Unlimited
Suspicious Login Emails	1,000	5,000	Unlimited
Features
AI Powered Detection
Weekly Summary Emails
2FA
Remove Branding from Emails
Members	3	15	Unlimited
Support
Email Support
Priority Support
Video Call Support
SLA's

All plans include upgrade, downgrade, and cancel anytime.

Score your first login in the next five minutes

1,000 free checks every month. No credit card. Install in one prompt.