However due to rampant abuse (potentially a small scale DDOS) we're contemplating requiring users to sign up to access the free tier.
Does anyone think this is a bad idea that might reduce uptake of our API?
* Do I trust you with the data I give you; and
* What do I get in return for my data?
If you are clear and upfront that the sign-up has been introduced because of lots of bogus accesses, you'll gain some sympathy. But people will still ask both of those questions.
If you act in a trustworthy manner, and you provide value in return, then I think it's fine to ask for a sign-up. But you need to gain the user's trust, both that you will treat their data with respect, and that there will be something in return.
Exactly how you convince them of those two things is not easy, and effectively "marketing".
Like, so that people can just hit your endpoint as a test, allow like 25 requests a day without a key, and then free tier with registration at 1500? That way you don't lose the instant "just try it" factor?
That being said, asking for a verified email address to use your free service is hardly questionable. Declare it for abuse management and ensuring you can be contacted if you do something weird with the endpoint, perhaps.
It's even fair to have a checkbox to get marketing email about your paid service, though I'd leave it unchecked by default if you want to be a good guy in today's society.
I don't know which API you are at, but I use OpenWeatherMap, and usually, do so with a city ID to request the location. But you can query OpenWeatherMap by GPS (I don't, myself), and you could be querying it using precise coordinates. So if OpenWeatherMap were to have a security breach, my location history might be leaked, and I'd like to know that... even if I'm on the free tier.
Thanks again!