Day 3: someone made 18 accounts in 30 minutes. What I changed on my DeepSeek gateway (free credit removed, DNS checks, agent-created accounts) and what’s coming

I run Fikra API (disclosure: it’s my project), a small OpenAI-compatible gateway. This is a follow-up to my 1B-tokens/day thread. Part of the plan changed because of abuse, and I’d like feedback from people who have dealt with it. What happened Today one source created more than 18 accounts in under 30 minutes. About half the email addresses bounced, which pushed the bounce rate on my sending domain way up. It looked like credit farming. What I changed Email checks: every signup email gets a DNS check (dnspython). If DNS doesn’t resolve, no account is created and the user is asked to try again. It isn’t perfect, since at least one bad address still got through and bounced. Signup limits: 3 attempts per IP per day. No more free credit: the free $1 credit is gone, and accounts activate on a first top-up. That filters out farmers and people who never meant to use it. If you saw “$1 credit, no card” in my earlier posts, that’s out of date. Onboarding: lots of people signed up and never made a call. The dashboard now opens with copy-paste snippets, so you can create a key and make a live request in under 5 minutes. Billing and account pages show more detail too. Agent-created accounts (new) For agents that are directed by humans (chat apps, Codex, coding agents) and can’t use a UI: an agent can create a temporary account that lasts 6 hours and gives the human a link to claim it. Once claimed, it becomes a full account. Temporary accounts have a spending cap of $100/day, and anything above that needs the human’s authorization. This is separate from the x402 lane for fully autonomous agents, which needs no signup and pays per call. What’s coming: a pinned DeepSeek line Additional DeepSeek models served through an upstream provider, pinned to specific builds, with peak and off-peak pricing in the same structure as the official API. They’ll be priced higher than my current DeepSeek models. The current models stay as they are, and this is another option. Exact rates and the peak window will be on the pricing page before launch. Still pending from the last thread (not forgotten): the production cache hit rate (logging is live, still collecting), a daily canary against the official API, my upstream’s written answer on precision, and the audit of what my gateway stores. Questions Top-up-first activation, or a small free credit with stricter limits: which would you trust more as a user? If you run an API, how do you handle abuse? For agent-created accounts, are 6 hours and $100/day sensible? What would you try to abuse? For a pinned line, do you care more about the build never changing or about peak/off-peak pricing? Would you pay more for pinned builds at all? Should peak windows copy the official API’s exactly, or follow the upstream’s real load? Rates for the current models: fikraapi.co.ke/deepseek Agent created accounts: fikraapi.co.ke/for-agents