Will breach checks add latency to logins?

Only for the logins you choose to check. Most studios call the API on new-device logins and sensitive actions, not on every session refresh, keeping the normal path fast.

What if a player has no email on file?

The email breach endpoint needs a valid email address. For accounts without one, rely on password checks at signup and your existing device and behavior signals.

Can we check emails for a whole player base at once?

You can, but within 60 requests per minute and at 1 credit per lookup. Many teams start with high-value accounts, such as those with rare items or stored payment methods.

Email breach checks · Gaming

Email breach checks for game accounts and trades

Game account takeovers usually follow a pattern: a login from an unfamiliar location, a burst of trades or marketplace listings, then an email change. Checking the account email against known breaches at the first step gives your platform a reason to ask for a second factor before inventory starts moving.

Support teams benefit too. When a player writes in claiming to be locked out, an agent who can see that the account email appears in password-exposing breaches knows to follow a stricter recovery script. That small cue helps protect valuable accounts from social engineering without slowing down routine, low-risk tickets.

Try it in the sandbox About email breaches

USE CASES

Where it fits in gaming

Trade and gifting holds
Before a player trades or gifts high-value items from a new device, check the email and apply a short trade hold or second-factor prompt when it appears in password-exposing breaches.
Recovery ticket triage
Show support agents the breach status of the account email in the ticket view, so claims to change email or remove two-factor authentication on exposed accounts get extra verification.
Launcher login risk
Add breach data to the risk signals your launcher or web login already evaluates, alongside IP reputation and device history, to decide when to require an emailed code.
Security reward prompts
Encourage players with exposed emails to enable two-factor authentication, for example with a cosmetic reward, turning breach data into a positive security nudge rather than a warning.

HOW TO INTEGRATE

The workflow

1
Store FINOWL_API_KEY in the account service behind your launcher and web logins.
2
Call POST /v1/breaches/email for logins from new devices, high-value trades and email change requests.
3
Reduce the response to a breached flag and a count of breaches that exposed passwords.
4
Use the result to choose between allowing the action, applying a trade hold or requiring a second factor.
5
Queue checks during launch-day spikes and respect Retry-After on any 429 response.

POST /v1/breaches/email

curl https://api.finowl.co/v1/breaches/email \
  -H "Authorization: Bearer $FINOWL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "player.one@example.com"
}'

Returns breached and the list of breaches with exposed DataClasses. Combine it with device and trade signals before adding friction.

GOOD PRACTICE

Before you ship

Launches and events can bring huge login spikes. Check only risk-relevant events, since the API allows 60 requests per minute per account and returns 429 when exceeded.
Many players are young. Keep any security messaging simple and calm, and describe breach screening in a privacy notice written for your actual audience.
Avoid permanent bans or inventory locks based on breach data alone. Temporary holds and second-factor prompts protect players while keeping legitimate play uninterrupted.

Read the API reference for every field and error code. Each lookup costs 1 credit; see pricing.

A FEW GOOD QUESTIONS

Common questions