Get in · data card
98 of 101 products offer sign-up with an email address alone.
5 of 101: our agent stopped by a phone check.
0 of 101: our agent stopped by an email check.
101 products, driven 1 Oct to 28 Oct 2026.
98 of 101 products we drove in October 2026 offered sign-up with an email address alone, by password or emailed code. A phone number or SMS code stopped our agent at 5 of 101 products, and an email check at 0 of 101.
We drove sign-up at 101 products from 1 to 28 Oct 2026 and recorded each way to make a new account, from the sign-up page or the product’s docs.
What our agent met at sign-up, across 101 products
Email and password was the most common way in, at 80 of 101 products. Social sign-in followed at 43 of 101, and an emailed code or sign-in link at 26 of 101. Social sign-in as the single way in appeared at fewer than 5 of 101.
Products offering each way to make a new account, 101 products driven 1–28 Oct 2026. A product can offer several, so the counts overlap:
| Way to make a new account | Products |
|---|---|
| Email address alone (password or emailed code) | 98 of 101 |
| Email address and password | 80 of 101 |
| Emailed code or sign-in link | 26 of 101 |
| Social sign-in (Google, GitHub, Apple or Microsoft) | 43 of 101 |
| Google sign-in | 38 of 101 |
| GitHub sign-in | 22 of 101 |
| Social sign-in only | fewer than 5 of 101 |
A phone number or SMS code stopped our agent at 5 of 101 products. An email check, meaning an address refused or a verification not finished, stopped it at 0 of 101. The median wait for the sign-up mail was 13 seconds, driven 1–28 Oct 2026.
Social sign-in is an extra door, and GitHub requires a human to create the account behind it
Social sign-in was the single way in at fewer than 5 of 101 products.
GitHub’s own terms rule out an agent opening the GitHub account your button depends on (docs.github.com[1]). GitHub’s Terms of Service say: “You must be a human to create an Account.” (docs.github.com[1]) They also say: “Accounts registered by “bots” or other automated methods are not permitted.” (docs.github.com[1]) GitHub’s Acceptable Use Policies prohibit “inauthentic interactions, such as fake accounts and automated inauthentic activity;” (docs.github.com[2])
For a social-only product, a device flow still needs a person: RFC 8628’s device authorization grant has the user review the request on a secondary device such as a smartphone (rfc-editor.org[3]).
A phone check stopped our agent at 5 of 101
A phone check stopped our agent at 5 of 101 products. In Supabase and Firebase, phone sign-in is something the developer turns on (supabase.com[4], firebase.google.com[5]).
- Supabase: phone login has to be enabled on the Auth Providers page and needs an SMS provider: “You also need to set up an SMS provider.” (supabase.com[4])
- Auth0: offers passwordless sign-in by SMS one-time password: “With this implementation, OTPs are sent to users’ phone numbers via SMS.” (auth0.com[6])
- Clerk: for SMS, “By default, only the US and Canada are enabled” (clerk.com[7]).
- Firebase: phone sign-in has to be enabled for the project first, and its docs warn that phone-only authentication is weaker than its other methods (firebase.google.com[5]). “Firebase uses reCAPTCHA to prevent abuse” of phone number verification (firebase.google.com[5]).
A phone check also has a running cost. Twilio’s Verify pricing page lists “$0.05 per successful verification + $0.0083 per SMS (US)”, as of 28 Oct 2026 (twilio.com[8]).
It brings a known fraud pattern too. Twilio says “SMS pumping fraud happens when fraudsters take advantage of a phone number input field”, such as a sign-up or verification form (twilio.com[9]). The fraudsters take a share of the revenue the triggered messages generate; in Twilio’s words, “The MNO is complicit in the scheme and has a revenue sharing agreement with the fraudsters.” (twilio.com[9])
What to change in your product
Keep an email-only way in, and do not make social sign-in the single door. If you want agents as users, take the phone check out of sign-up and filter abuse another way.
- You offer only GitHub sign-in. Add email sign-up; 98 of 101 products we drove have it.
- You are choosing between a password and an emailed code. An email check stopped our agent at 0 of 101 products, so pick on other grounds. Know your provider’s default. Supabase’s email OTP method sends a magic link by default (supabase.com[10]). At Auth0, “Magic links can only be implemented in Classic Login.” (auth0.com[6]) Clerk offers both an emailed code and an emailed sign-in link (clerk.com[7]).
- You ask for a phone number at sign-up. That check stopped our agent at 5 of 101. Move it to a later step that needs it. If you keep it, Twilio’s guidance is to “get the line type of a number then only send SMS to mobile numbers” (twilio.com[11]). Twilio’s Lookup Line Type Intelligence check costs “$0.008 per request”, as of 28 Oct 2026 (twilio.com[12]).
- You worry about abusive sign-ups. Use bot detection that tells AI agents apart from other bots. One example: WorkOS Radar can “Automatically block or challenge sign-in attempts that are initiated by a bot or program” and tell bot types apart, including AI agents (workos.com[13]).
Next: how to drop the phone check at sign-up.
How we measured
From 1 to 28 Oct 2026, our agent drove sign-up at 101 products where at least one way to make a new account was recorded, from the sign-up page or the product’s docs, and we logged what stopped it there. Results describe these 101 products in that window. Where a count is between 1 and 4, we show it as fewer than 5. Full method at /method; more studies in Research.
Questions owners and agent builders ask
Can an AI agent sign up for my product if I only offer Google or GitHub sign-in? Few products are in this spot: social sign-in only appeared at fewer than 5 of 101 we drove.
Is email and password or an emailed code easier for an agent to get through? An email check stopped our agent at none of the 101 products, whichever of the two the product used. Email and password was offered at 80 of 101 products and an emailed code or sign-in link at 26 of 101.
Does requiring a phone number or SMS code stop agents, and is that what I want? It stopped our agent at 5 of 101 products. It also costs money per check: Twilio lists “$0.05 per successful verification + $0.0083 per SMS (US)” (twilio.com[8]). And a phone field is where SMS pumping fraud starts (twilio.com[9]). If you want agents as users, a phone gate at sign-up works against you.
How many SaaS products still let you sign up with just an email address? Of the 101 products we drove from 1 to 28 Oct 2026, 98 offered an email-only way in. Fewer than 5 offered social sign-in only.
How long does a verification email take to arrive, and will an agent wait for it? In our drives from 1–28 Oct 2026, the median wait for the sign-up mail was 13 seconds. Our agent was not stopped by an email check at any of the 101 products, an unfinished verification included.
If I want agents as users, which sign-up method should I add first? Email sign-up, without a phone check. It was a way in at 98 of the 101 products we drove.
How do I keep abusive bot sign-ups out without blocking legitimate agents? Filter by behaviour, not by phone. WorkOS Radar can block or challenge sign-ins started by bots and tell bot types apart, including AI agents (workos.com[13]). If you keep SMS, Twilio advises sending it only to mobile line types (twilio.com[11]). A phone check stopped our agent at 5 of 101 products.