If you have useful API's with a free tier, users will be constantly trying to steal them.

I've had to require email verification, non-cloud IP signup, block signup from IPs of already blocked users, in order to combat abuse. In all of these cases the user is just prompted to add a card to continue using.

I wish it weren't this way though, as it does harm the user's experience...