import { checkBotId } from "botid/server";
export async function POST(req: Request) {
  const { isBot } = await checkBotId();
  if (isBot) {
    return new Response("Access Denied", { status: 403 });
  }
  const result = await expensiveOrCriticalOperation();
  return new Response("Success!");
}

Link to headingHow BotID works

BotID is available in two modes: Basic (enabled by default) and Deep Analysis, which adds advanced detection checks.

Detection starts at the session level. BotID injects lightweight, obfuscated code into the requester’s environment that evolves on every load and is designed to resist replay, tampering, and static analysis. It runs invisibly with no CAPTCHAs or changes to the user experience.

Unlike traditional defenses, BotID doesn’t rely on static signals like user-agent headers or IP ranges, which are easy to fake and become outdated. It also avoids more intrusive methods like CAPTCHAs, heuristics, and reputation scores, which can frustrate or block real users.

Instead, BotID counters the most advanced bots by:

• Silently collecting thousands of signals that distinguish human users from bot

• Mutating detection logic on every load to prevent reverse engineering and making spoofing difficult

• Feeding attack patterns into a global machine learning network that continuously improves protection for all

BotID is fast, reliable, and built for developers. Server-side verification takes a single function call. There's nothing to configure, no API keys to manage, and no scores or thresholds to tune. Requests that are tested for validation are returned with an unambiguous pass or fail answer.

Link to headingDeep Analysis powered by Kasada

BotID with Deep Analysis is powered by Kasada, whose detection engine protects some of the most targeted platforms on the internet. Their system is hardened against real-world adversaries: bots that retool quickly, replay sessions, and adapt to static defenses.

Because Kasada is integrated directly into the Vercel platform, there’s no separate service to sign up or set up. Just install the package, define routes you want to block automation on, and deploy.

We've been using Kasada’s enterprise-grade defenses to protect our own high-value apps, like v0.dev, for a while now. Now you can do the same. Kasada’s detection runs automatically with your deployment, bringing enterprise-grade protection to your most critical routes.

Link to headingBotID: For teams of all sizes

BotID is designed for teams dealing with targeted automation that slips past conventional defenses. These aren’t generic bots, they behave like real users, and move through high-value flows, creating real cost when left unchecked.

That might look like scalpers attacking limited checkouts, fake accounts flooding signups, or credential stuffing targeting login endpoints. It also includes scraping against dashboards, pricing pages, or APIs that expose business logic or drive up compute.

BotID is built to protect the parts of your app that matter most, without getting in the way of actual users.

Link to headingAvailable now

We already protect against automated traffic with platform-level protections like DDoS mitigation, WAF rules, and bot challenges for non-browser clients. BotID extends that protection as a new sophisticated layer designed to block automation that mimics real users targeting the most critical routes.

BotID is available now for all teams, with Deep Analysis powered by Kasada available for Pro and Enterprise teams.