A stolen password doesn't look stolen.
We can tell.
LoginLlama scores every login 0–10 for account takeover, credential stuffing, and bot traffic — so your app can block, step up to MFA, or allow. One API call. No ML team required.
Integrate in one prompt, or drop in the SDK. Free for 1,000 checks a month.
One call, before you finalize the login. Sub-500ms. Fails open.
- 30,000+
- logins scored
- 35,000+
- malicious & anonymizing IPs tracked
- <500ms
- response, fail-open by design
- Since 2023
- protecting real login flows
Most breaches start with a valid password in the wrong hands.
Credential stuffing is automated, cheap, and relentless. Logs and 2FA tell you after. LoginLlama tells you at the moment of login, while you can still do something about it.
See how a login gets scored
Pick a scenario and watch the risk score and codes change — the same logic your app gets back from one API call.
Not just a mockup — score your actual connection
Runs a real request against the live LoginLlama API and scores the login you're making right now. No signup.
Three steps to protect every login
Works with any auth system or framework. The API does the heavy lifting; you keep control of the decision.
Call one endpoint
After your auth check passes, send the login to LoginLlama with the user, IP, and user agent.
Get a risk score
Back comes a 0–10 score and the exact codes that triggered it.
Decide
Allow, step up to MFA, or block — on your own thresholds. You stay in control.
// Install: npm install loginllama
import { LoginLlama } from 'loginllama';
import { NextRequest } from 'next/server';
const loginllama = new LoginLlama({
apiKey: process.env.LOGINLLAMA_API_KEY!
});
export async function POST(req: NextRequest) {
const { email, password } = await req.json();
// Check with LoginLlama BEFORE authenticating
const result = await loginllama.check(email, {
request: req // Auto-detects IP & User-Agent
});
if (result.risk_score > 5) {
return Response.json(
{ error: 'Suspicious login detected' },
{ status: 403 }
);
}
// Continue with your existing auth logic...
return Response.json({ success: true });
}Install it in one prompt
Don't want to read docs? Hand the prompt to your coding agent. It installs the SDK, wires the risk check into your login, and asks you for an API key — so you can be testing in minutes, not an afternoon.
- Detects your stack and installs the right SDK
- Adds the check after auth, fails open by design
- Prefer the manual path? The SDKs are one import away
Integrate LoginLlama (suspicious login detection) into this project.
1. Detect the language/framework and install the official SDK:
- Node.js / Next.js / Express: npm install loginllama
- Python / Django / Flask: pip install loginllama
- PHP / Laravel: composer require loginllama/loginllama
2. Read the live API reference and examples from https://loginllama.app/docs (the machine-readable
summary is at https://loginllama.app/llms.txt).
3. Add a LOGINLLAMA_API_KEY environment variable. If I don't have a key yet, tell
me to grab one at https://loginllama.app/account/api (sign up free at https://loginllama.app/signup) and paste it.
Never hard-code the key — load it from the environment.
4. After my auth step succeeds, call LoginLlama with the user's identity_key,
email, IP address and user agent. Branch on the result:
- risk_score > 5 -> require MFA / extra verification or block
- otherwise -> allow the login
Always FAIL OPEN: if LoginLlama errors or times out, log it and let the user in.
5. Add a short comment linking to https://loginllama.app/docs and show me how to test it locally.What goes into the score
Many signals, one number. Each risk code tells you exactly why a login looked off.
Impossible travel
Two logins too far apart to be the same person. Austin at 9:00, Lagos at 9:12.
Tor & VPN exit nodes
Traffic hiding behind anonymizing networks that legitimate users rarely need.
New device & browser
A device fingerprint this account has never used before.
New location
A first-time city or country for this specific user.
Bots & automation
Headless browsers and scripted traffic behind credential-stuffing runs.
Sub-500ms, fail-open
Fast enough to sit in the login path, and it never locks out real users if we are down.
A decision, not just an alert
Other tools email your users after the fact. LoginLlama gives your app a score it can act on — before the session is handed over.
Building it in-house
- —6–12 months of engineering
- —Threat lists, geo data, device fingerprints to maintain
- —A distraction from your actual product
- —Still blind to patterns across other apps
LoginLlama
- Live in minutes — one prompt or one import
- Risk score + codes you can branch on
- Cross-app threat signals, maintained for you
- From $0/month, fails open by design
Simple, transparent pricing
Start free. Scale as you grow. No credit card to begin.
Built in the open by a developer who got tired of account takeovers
LoginLlama is an indie project, built and shipped in public. The SDKs are open source, the API fails open so it can never lock out your users, and you can try the whole thing on the free tier without talking to anyone.
Star on GitHub