How can I protect my application's register API from spammers without using CAPTCHA?

Question

My app has a register service that users can register themselves. However, someone with malicious intent can write a script to register thousands of accounts in seconds.

My back-end developer suggests we use captchas in our mobile apps. However I don't see any apps that are using captchas and they are bad UX.

My question is how to prevent this kind of attacks and secure our services in our app?

Answer 1

At my current job, we're working on a passive mobile captcha SDK called HumanDetect. It is transparent to your end users. It grabs sensor data to decide if the phone is being held by a human or not.