How to stop free credit farming.
Farming stops paying when claiming your grant costs the operator more than the grant is worth. These are the changes we recommend to AI and API companies, drawn from what got past the signup flow in Case 001. Your engineers decide which fit, and none of them needs Esuba.
Six changes to your signup flow
Put a captcha on every signup route, OAuth included
Farms find the route with the least friction. In Case 001 the email route had a captcha and the sign-in-with-GitHub route didn't, so that became the operator's main way in.
Grant credit on account signals
For OAuth signups, check the account's age, activity and whether its email is verified before granting credit. Pools of fresh accounts are cheap; aged, active ones aren't.
Block farm domains by parent domain
Free subdomain services hand out endless subdomains. Block the parent so one rule covers them all, and normalise addresses so Gmail-style aliases count as one inbox.
Rate-limit grants per IP, network and device
Limit how many grants one IP address, network (ASN) or device can claim, not just how many accounts it can create.
Hold the credit until the first real API call
Grant credit when the account first does real work, or cap what a brand-new key can spend. A farm wants credit it can drain or resell straight away.
Audit existing grants and revoke farmed keys
Match past grants against the patterns you find, such as shared parent domains, one OAuth route or a burst of signups, and revoke the keys that fit before they're resold.
Why fixes alone don't end it
Every change closes a door, and operators look for the next one. In Case 001 the operator moved from Gmail aliases to catch-all domains to OAuth signups within five days.
Fixing the signup flow works best alongside taking down the toolkit and tracking whoever runs it. See farm toolkit takedowns.
Questions
Which change should we make first?
Whichever closes the route the farm uses right now. The toolkit's own README often says which route that is; finding it is part of our free farm exposure report.
Will these changes hurt real signups?
Some add friction. Holding credit until the first API call and checking OAuth accounts' age and activity are rarely noticed by genuine users.