Detect API Abuse with Smart Actions

The Pattern

Credential stuffing and API abuse show up as clusters of auth failures in a short window — 50 failed login attempts in 5 minutes from the same IP is a very different signal than 1 per hour.

Smart Actions detects the cluster automatically.

Step 1: Log Auth Failures

// In your auth handler
export async function handleLogin(email: string, ip: string, success: boolean) {
  if (!success) {
    await logit.now("security", {
      event: "Auth failure",
      description: `Failed login for ${email}`,
      icon: "🔒",
      notify: false,
      tags: { ip, reason: "invalid_credentials" },
      metadata: { email, ip, userAgent: req.headers.get("user-agent") },
    });
  }
}

Step 2: Create the Abuse Detection Rule

Field	Value
Name	Auth failure spike
Channel	security
Event name	Auth failure
Threshold	20
Window	5 minutes
Cooldown	15 minutes
Action	Push notification
Push title	🔒 Auth failure spike
Push body	20+ failed logins in 5 minutes

Step 3: Add a Slack Alert for the Security Team

Create a second rule with the same trigger but a Webhook action pointing to your #security Slack channel:

Field	Value
Name	Auth failure spike → Slack
Channel	security
Event name	Auth failure
Threshold	20
Window	5 minutes
Cooldown	15 minutes
Action	Webhook
URL	Slack incoming webhook URL

Response Playbook

When the alert fires:

Check the Trigger History in Smart Actions to see the exact count
Open the Events dashboard, filter by channel = "security", look at ip tags
Block the IP at your WAF or rate limiter

Tips

Use a low threshold (20 in 5 min) for early warning. A legitimate user doesn't fail 20 logins in 5 minutes.
Log ip in tags (not just metadata) so you can group by IP in the LogIt dashboard without parsing JSON.
Add a separate rule for password reset abuse: event: "Password reset requested", threshold 10 in 10 min.

Logit