Trial abuse prevention for Rails

The tag, in the signup view

It loads asynchronously, renders nothing, and exchanges a device hint for a signed token that lives five minutes. No decision is ever made in the browser, so nothing here can be edited by a visitor to change the outcome.

<script src="https://onetrial.dev/v1.js" data-key="YOUR_PUBLIC_KEY" async></script>

Read the token when the form submits and send it along with the rest of the fields.

// Signup form (browser): include the token in your POST
const token = await OneTrial.getToken();      // window.OneTrial is set by the snippet
OneTrial.markSubmit();                        // records time-to-submit
formData.append('visitorToken', token);

The call, in the create action of your registrations controller

Your key stays on the server. Send the token, the canonical email and the client IP, plus a card fingerprint and your own user id when you have them. The median answer takes under 300ms.

res = Net::HTTP.post(URI("https://onetrial.dev/api/v1/decisions"),
  { visitorToken: visitor_token, email: email, ip: request.remote_ip, userId: user.id }.to_json,
  "Authorization" => "Bearer #{ENV.fetch('ONETRIAL_API_KEY')}", "Content-Type" => "application/json")
d = JSON.parse(res.body)
return render_paid_plan if d["decision"] == "deny"
return redirect_to d["challengeUrl"], allow_other_host: true if d["decision"] == "challenge"
create_trial(user)

The three answers

allow creates the trial as normal. challenge asks for one proof, either on a page we host at challengeUrl or inside your own UI, and the trial unlocks on the challenge.completed webhook. deny shows a paid plan or a way to reach you.

Never show the score or the reasons to the visitor. They are for your dashboard, your logs and your own judgement, because anyone told which signal caught them knows what to change next time.

Or let the CLI write it

It detects Rails, writes the environment variables, injects the tag and then calls the API once to prove the install works before it reports success.

npx onetrial init

Before you enforce anything

Every new workspace starts in shadow mode: signups are scored and recorded, and your Rails app is always told allow. Read a week of your own decisions first, then turn enforcement on when the answers match the judgement you would have made yourself.