Spam Detection API for Forms, Signups & User Content
One JSON API, three endpoints — email check, text analysis, or both. Block spam before storing forms, creating accounts, approving comments or forwarding leads. 3,000 free credits on signup, no CAPTCHA ever.
curl -s -X POST \
'https://nobotiq.com/api/v1/spam/mail' \
-H 'Authorization: Bearer $TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"email": "spam@temp-mail.org"
}'
{
"decision": "spam",
"confidence": "high",
"reasons": [
"disposable_domain",
"low_reputation"
],
"duration_ms": 138
}
curl -s -X POST \
'https://nobotiq.com/api/v1/spam/text' \
-H 'Authorization: Bearer $TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"content": "Visit https://spam-link.com",
"context": "blog_comment"
}'
{
"decision": "spam",
"confidence": "high",
"reasons": ["seo_linkdrop", "ai_generated"],
"duration_ms": 214
}
curl -s -X POST \
'https://nobotiq.com/api/v1/spam/hybrid-check' \
-H 'Authorization: Bearer $TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"email": "real-user@example.com",
"content": "Hi — loved the article!",
"context": "contact_form"
}'
{
"decision": "clean",
"confidence": "high",
"reasons": ["clean_domain", "human_tone"],
"duration_ms": 241
}
Detect Spam Before You Process It
Spam costs you twice — once when it pollutes your database and again when your team cleans it up. NoBotIQ runs before any store / create-account / queue-send step, so the expensive parts of your pipeline see only genuine requests.
Less junk in the DB
Blocked submissions never become user rows, form entries, comment nodes or support tickets. Tables stay small, backup sizes stay sane, dashboards stay honest.
Real leads to the inbox
Marketing and sales teams stop digging through 47% junk to find the real lead. Conversion reporting matches actual traffic, not bots.
Lower downstream costs
Every spam account turned away today is one less Stripe fraud alert, SES bounce, Zendesk ticket and manual GDPR export tomorrow. Save the budget for real work.
Three Ways to Check Submissions
Every endpoint returns the same decision shape: decision (spam / clean / review), confidence, reasons array, duration_ms. Easy to swap modes without rewriting the integration.
Email reputation
Disposable domains, throwaway Gmail aliases, known spammer domains, typo-squat lookalikes. The fastest, cheapest signal — and usually the one that already catches 70% of the obvious abuse.
· sub-150ms median
AI text analysis
SEO link drops, copy-pasted templates, spun articles, AI-generated fluff and obvious scam pitches. Works without an email field — comments, reviews, anonymous contact, forums.
· sub-250ms median
Hybrid check
Email + text combined in one API call. Highest catch rate, and the only mode we recommend for open public forms. Every signal is independently logged so audits are trivial.
· sub-300ms median
Built for Real Application Workflows
Hook the API into the exact spot where you currently accept user input. One short integration, five years of quiet mornings.
Simple API Integration
Four tiny changes to your existing submit handler. That's the entire integration surface.
No CAPTCHA Required
Challenges train your users to solve puzzles for attackers. Every CAPTCHA on the internet is a free dataset for the next bot farm.
NoBotIQ runs on the server, invisible to humans and obvious to bots. Users click submit once. Real submissions get through. Fake submissions get blocked. That is the whole interaction.
- No score-threshold tuning (reCAPTCHA v3 teams know the pain).
- No broken puzzles for accessibility users or mobile visitors.
- No cookie consent required for a challenge widget.
- Form completion rate goes up — spam goes down.
Pay Only for What You Use
No per-seat, no per-domain, no per-endpoint, no monthly minimum. A credit is a credit. Top up when the balance hits zero.
- Credit card — not required
- All three endpoints
- OAuth2 client credentials
- Full dashboard + logs
- No fixed rate per call — credits scale with the size of each submission
- ≈120 credits for a typical email check, more for longer text or hybrid
- Stripe top-up — any amount
- Credits never expire
- 10% – 25% volume discounts
- 99.95% uptime SLA
- Dedicated Slack / Discord channel
- On-prem / VPC peering option
Add Spam Detection to Your Application Today
Create a free account, grab OAuth2 credentials from the dashboard, and call one endpoint from your submit handler. By this time tomorrow you will have blocked more spam than your team deletes in a typical week.
Questions engineers usually ask
The short version before you open the OpenAPI spec.
Three endpoints. /spam/mail runs only email reputation checks. /spam/text runs only AI content analysis against the submission body. /spam/hybrid-check runs both and merges the result into one decision — this is the mode we recommend for most public forms because it catches both throwaway addresses and copy-paste campaigns.
Yes. The API is stack-agnostic — call it from Node, Python, PHP, Go, Rails, Cloudflare Workers, serverless functions or your favourite form-backend middleware. Send a POST with JSON, get a JSON decision back, branch in your submit handler. Done.
High-confidence blocks are safe by default. For the narrow "review" band (usually < 2% of traffic) we recommend routing to a manual queue or a CAPTCHA fallback instead of an outright block — this gives you the cleanest possible path with zero false positives on real users. The decision + confidence shape is documented so you can map exactly what to do per form.
CAPTCHAs leak your UX budget to solve a server-side problem. The majority of real CAPTCHA traffic on the modern web is already farm-solved humans, not bots. NoBotIQ keeps the challenge off the user and on the server, where it belongs — and it catches a wider range of abuse patterns than a puzzle ever can.
OAuth 2.0 Client Credentials flow. You create a client in the dashboard, exchange the ID + secret for a short-lived bearer token, cache that token on your side, and call the API. No vendor SDK required — standard HTTP clients and any existing OAuth2 helper work out of the box. Raw curl examples are in the docs.
Yes. 3,000 credits are applied to every new account automatically on signup. That is enough to protect a mid-size form for weeks and see exactly what the API is blocking. No credit card, no sales call, no calendar link required to start.