Framework: Express
Suspicious login detection for Express
Add suspicious login detection to Express middleware flows.
Add LoginLlama to Express in one call
Call LoginLlama from your Express login handler before you create the session. Send the email, IP, and user agent, then allow, challenge, or block based on the returned risk score.
// Install: npm install loginllama
import express from 'express';
import { LoginLlama } from 'loginllama';
const app = express();
const loginllama = new LoginLlama({
apiKey: process.env.LOGINLLAMA_API_KEY
});
// Add middleware for auto IP/UA detection
app.use(loginllama.middleware());
app.post('/login', async (req, res) => {
// Check with LoginLlama BEFORE authenticating
const result = await loginllama.check(req.body.email);
if (result.risk_score > 5) {
return res.status(403).json({
error: 'Suspicious login detected'
});
}
// Continue with your existing auth logic...
res.json({ success: true });
});Why teams choose LoginLlama for Express
Score every login in under 100ms
Detect VPNs, proxies, and TOR exit nodes
Explain why a login is risky with clear risk reasons
Catch errors from the check and logins go ahead during an outage
How it works
Step 1
Install or connect LoginLlama
Choose the SDK or integration point that fits your auth flow and add your API key.
Step 2
Check risk at login time
Send the email, IP, and device context before completing authentication.
Step 3
Act on the risk score
Allow, challenge, or block the login based on risk score and reasons.
Signals we analyze
New device or browser fingerprints
Impossible travel and velocity checks
Bot-like login bursts and credential stuffing
Geo anomalies and risky IP reputation
Works well with your Express stack
Express login security FAQ
How do I add suspicious login detection to Express?
Make a single POST request to https://loginllama.app/api/v1/login/check from your Express login handler before you create the session. Send the user's email, IP address, and user agent, and branch on the returned risk score.
Will LoginLlama slow down Express logins?
No. Risk scoring returns in under 100ms. If LoginLlama is unreachable the check throws an error, so catch it and let the Express login go ahead. An outage then never blocks a real user.
What does LoginLlama detect on Express logins?
New devices and browser fingerprints, impossible travel and login velocity, credential-stuffing bursts, and traffic from VPNs, proxies, TOR exit nodes, and high-risk IPs — each returned with a clear, human-readable reason code.
Does LoginLlama work with Express middleware, Passport.js, Custom auth?
Yes. LoginLlama runs at the login step itself, so it works alongside Express middleware, Passport.js, Custom auth and the rest of your Express stack without replacing your existing authentication provider.
Other integrations
LoginLlama works with the same single API call across every stack.
Express login protection
Protect Express users from suspicious logins
Add LoginLlama in minutes and block risky logins in real time.