Sign-ups
Keep automated registrations from flooding your product.
Trust, without the interruption
Make abuse expensive.
Keep users moving.
Duckity is invisible abuse protection that works across web apps, APIs, native apps, CLIs, and headless applications. Detect and slow down automated abuse without CAPTCHAs or interrupting legitimate users.
No card required 10,000 requests protected free every month
Request validatedLow risk · 24ms
LIVEThreat cost increasedAutomated pattern contained
Stop abuse before
it reaches your product.
Login attempts
Spot credential abuse while good users keep moving.
API requests
Apply consistent risk decisions across every endpoint.
Password resets
Protect account recovery from automated takeovers.
Promotions and forms
Keep campaigns and submissions useful and fair.
Why duckity
Security that stays
out of the way.
Strong enough for the messy internet. Thoughtful enough for your users.
01
Invisible by default
Keep every interaction clean. Duckity works in the background, so good users never have to prove they are human.
Learn more02
Policies built around your risk
Tune heuristics, correlate behavior, and shape rate limits around the exact risk profile of your product.
Learn more03
Built for any scale
From your first launch to a global platform, protect every surface without slowing down legitimate users.
Learn more Less noise, more signal
Don't challenge
your users.
Abuse is a moving target. Duckity combines the signals that matter, adapts to new patterns, and lets your team decide exactly where to draw the line.
Explore the platform Policy activeproduction / global
Sign In Policy •••
Behavioral heuristicDetect repeated automated flows
Correlation signalLink activity across surfaces
Rate limit5 requests / hour
Built for your stack
Three lines in.
Protection everywhere.
Drop duckity into your web app, API, mobile client, agent, or edge layer with the same simple validation flow. Start with a signal, then make it yours.
Read the docsserver.ts
const isValid = await duckity.validate(solution, clientIp, applicationSecret, policyId);client.ts
const solution: string = await duckity.solve(POLICY_ID); Privacy, by design
Your users deserve
privacy by default.
Duckity protects end users without turning them into profiles. We make decisions from signals, collect only what is needed to protect your product, and never sell or share personal data.
Read our privacy principles →Privacy controlsAlways on · across every surface
ProtectedData minimizationOnly the signals needed for a decision
No identity profilesProtection without tracking people
Built-in retention limitsSignals expire when they're no longer useful
Simple, predictable pricing
Start small.
Scale without surprises.
Free
Start building The essentials for your first protected product.
$0 / month
Protects 10,000 requests / month
- Cross-platform SDKs
- Core heuristics
- Protect 2 applications
- Create up to 3 policies per application
- Duckity attribution on protected forms
- Community support
Most popular
Pro
Get Pro For fast-growing products and teams.
$49 / month
Protects 100,000 requests / month
- Fully customizable heuristics
- Correlation + rate limits
- Protect 10 applications
- Create up to 15 policies per application
- White-label protected forms
- $1 per additional 2,000 protected requests
Anywhere you have users or requests to protect: web, mobile, APIs, native apps, CLIs, and edge services.
A validation is the complete protection flow: a client requests an invisible proof-of-work challenge, the client completes it silently in the background, and then sends the result to your server for verification. There is no CAPTCHA or user interruption. Pricing is based on challenges issued, because risk scoring, rate limiting, and related work happen when the challenge is created.
Yes. Combine heuristics, correlation signals, and rate limits into policies tailored to your product.
Ready when you are
Protect what you're
building.
Give your users a smoother experience and your team a quieter day.