BotID: A New Layer of Defense for High-Value Routes

Sophisticated bots no longer announce themselves. They execute JavaScript, solve CAPTCHAs, and move through interfaces with the same rhythm as a human user. Scriptable frameworks like Playwright and Puppeteer make it possible to imitate everything from page load to form submission, rendering traditional defenses—header checks, rate limits, IP reputation—increasingly ineffective.

Vercel's answer is BotID, a new protection layer designed to catch browser automation before it reaches your backend. It targets the routes where abuse carries real cost: checkouts, logins, signups, APIs, or any endpoint that triggers expensive operations like LLM-powered services. The implementation skips configuration files and tuning; the process involves installing a package, setting up rewrites, mounting the client, and verifying requests server-side.

import { checkBotId } from "botid/server";
export async function POST(req: Request) {
  const { isBot } = await checkBotId();
  if (isBot) {
    return new Response("Access Denied", { status: 403 });
  }
  const result = await expensiveOrCriticalOperation();
  return new Response("Success!");
}

Detection Without Friction

BotID operates in two modes: Basic, which is enabled by default, and Deep Analysis, which layers on advanced detection checks. At the session level, BotID injects lightweight, obfuscated code into the requester's environment. That code mutates with every load, designed to resist replay attempts, tampering, and static analysis. There are no CAPTCHAs and no visible impact on the user experience.

The system deliberately avoids static signals like user-agent strings or IP ranges—data that's trivial to forge and quick to go stale. It also steers clear of heuristic scores and reputation-based filters, which can penalize legitimate users. Instead, BotID:

  • Silently gathers thousands of signals that separate human behavior from automated behavior
  • Changes its detection logic on each load, complicating reverse engineering and spoofing
  • Feeds observed attack patterns into a global machine learning network that improves protection across all deployments

For developers, server-side verification is a single function call. There are no API keys to manage, no thresholds to tune, and no score to interpret. The result is binary: pass or fail.

Deep Analysis: Enterprise-Grade Hardening

The Deep Analysis mode is powered by Kasada, a detection engine already used to defend some of the most targeted platforms on the internet. Kasada's system is engineered to withstand real-world adversaries: bots that quickly retool, replay sessions, or adapt to static defenses.

Because Kasada is embedded directly into the Vercel platform, there's no separate service to sign up for or integrate. The same installation process applies—define the routes that should block automation and deploy. Vercel has used Kasada's enterprise defenses to protect its own high-value applications like v0.app, and BotID makes that level of protection available to any team on the platform.

Who Needs This Protection

BotID addresses a specific problem: targeted automation that passes conventional defenses. These are not broad, noisy bots. They act like real users and move through high-value flows, generating genuine cost when left unchecked. Typical abuse cases include scalpers hammering limited checkouts, fake account creation at signup, credential stuffing on login endpoints, and scraping of dashboards, pricing pages, or APIs that expose business logic or drive up compute usage.

Vercel already provides platform-level defenses against automated traffic, including DDoS mitigation, WAF rules, and bot challenges for non-browser clients. BotID extends that existing protection with a dedicated layer for stopping automation that mimics real users on the most sensitive routes.

BotID is available now to all teams. Deep Analysis, powered by Kasada, is available to Pro and Enterprise teams.