HN Explorer

Ask HN: Requiring users to sign up for free trial. Yay or nay?

2 points by jonathan-kosgei ↗ HN
We have an API product that has had a no signup or credit card free tier for a while now.

However due to rampant abuse (potentially a small scale DDOS) we're contemplating requiring users to sign up to access the free tier.

Does anyone think this is a bad idea that might reduce uptake of our API?

6 comments

[ 3.8 ms ] story [ 21.6 ms ] thread
ocdtrekkie
I am a bit surprised your free tier doesn't have a signup. Do you give people an API key, just like, randomly generated on the fly on page load?
jonathan-kosgei
Nope, you can call our endpoint without an API key but you'd be limited to 1500 requests a day.
ocdtrekkie
Would significantly limiting the endpoint without a key, but keeping it open for a quick test be an option?

Like, so that people can just hit your endpoint as a test, allow like 25 requests a day without a key, and then free tier with registration at 1500? That way you don't lose the instant "just try it" factor?

That being said, asking for a verified email address to use your free service is hardly questionable. Declare it for abuse management and ensuring you can be contacted if you do something weird with the endpoint, perhaps.

It's even fair to have a checkbox to get marketing email about your paid service, though I'd leave it unchecked by default if you want to be a good guy in today's society.

ocdtrekkie
Oh, another reason I realized you should have registration/people's email: While you wouldn't want to automatically send these people marketing emails without their express interest, you WOULD want to be able to send your free tier users security notices.

I don't know which API you are at, but I use OpenWeatherMap, and usually, do so with a city ID to request the location. But you can query OpenWeatherMap by GPS (I don't, myself), and you could be querying it using precise coordinates. So if OpenWeatherMap were to have a security breach, my location history might be leaked, and I'd like to know that... even if I'm on the free tier.

jonathan-kosgei
Thanks for the feedback, this does help. I'm wary of adding another step before users can get started with the API but it might become necessary to do so.

Thanks again!

ColinWright
These days, getting an email or other sign-up for something has (at least) two significant factors:

* Do I trust you with the data I give you; and

* What do I get in return for my data?

If you are clear and upfront that the sign-up has been introduced because of lots of bogus accesses, you'll gain some sympathy. But people will still ask both of those questions.

If you act in a trustworthy manner, and you provide value in return, then I think it's fine to ask for a sign-up. But you need to gain the user's trust, both that you will treat their data with respect, and that there will be something in return.

Exactly how you convince them of those two things is not easy, and effectively "marketing".