Piano Subscriptions
CAPTCHA
Piano ID supports CAPTCHA protection against spam and abuse, including credential stuffing and login attacks, through two providers: Cloudflare Turnstile and Google reCAPTCHA. Configuration and provider selection are described in Should I enable reCAPTCHA? and in Configuring Identity Management.
Brute force attack prevention
Login enumeration attacks are mitigated through rate-limiting applied at the Cloudflare layer, which temporarily blocks an IP address after a defined number of failed login attempts. Further detail on API rate limits is available in Rate Limitations of Piano API Endpoints.