Skip to Content

BotID

Resources

all plans

Sophisticated bots are designed to closely mimic real user behavior. They can run JavaScript, solve CAPTCHAs, and navigate interfaces in ways that closely resemble humans. Tools like Playwright and Puppeteer automate these sessions, simulating actions from page load to form submission. These bots aim to blend in with normal traffic, making detection difficult and mitigation costly.

Copy page

Vercel BotID is an invisible CAPTCHA that protects against sophisticated bots without showing visible challenges or requiring user action. It's a client-side challenge that uses machine learning to distinguish between humans and bots. It adds a protection layer to high-value routes, such as checkouts, signups, and APIs, that are common targets for bots imitating real users.

BotID validates clients with these steps:

View our BotID Next.js starter template


Get Started Open in v0

  1. A client-side challenge is sent to the browser.
  2. The browser solves the challenge and includes the solution in requests to your high-value endpoint.
  3. Your server-side code calls checkBotId()
  4. Vercel validates the integrity of the challenge response.
  5. Deep Analysis uses a machine learning model to analyze the client side signals, if configured.
  6. The server-side code receives the analysis result, where the application can take action.

Check levels

BotID can be configured to run at one of two levels, Basic or Deep Analysis. Deep Analysis runs only after the Basic validation has passed.

Basic

The Basic level validates the integrity and correctness of the challenge response, catching many less sophisticated bots. It is provided free of charge for all plans.

Deep Analysis

BotID includes Deep Analysis, powered by Kasada. Kasada is a leading bot protection provider trusted by Fortune 500 companies and global enterprises. It delivers advanced bot detection and anti-fraud capabilities while respecting user privacy and adapting to new bot behaviors in real-time.

Deep Analysis uses machine learning to analyze thousands of client side signals to further detect bots, in addition to the basic validation.

Deep Analysis provides real-time protection against:

  • Automated attacks: Shield your application from credential stuffing, brute force attacks, and other automated threats
  • Data scraping: Prevent unauthorized data extraction and content theft
  • API abuse: Protect your endpoints from excessive automated requests
  • Spam and fraud: Block malicious bots while allowing legitimate traffic through
  • Expensive resources: Prevent bots from consuming expensive infrastructure, bandwidth, compute, or inventory

Pricing

Deep Analysis counters the most advanced bots by:


Mode

Basic

Plans Available

All Plans

Price

Free

Deep Analysis

Deep Analysis

Pro

Enterprise

$1/1000 checkBotId() Deep Analysis calls

Custom

checkBotId() function in your code triggers BotID Deep Analysis charges. Passive page views or requests that don't invoke the checkBotId() function are not charged.


Bypassing BotID

You can add a bypass rule to the Vercel WAF to let through traffic that would have otherwise been detected as a bot by BotID.

BotID observability

You can view BotID checks by selecting BotID on the firewall traffic dropdown filter of the Firewall tab of a project.

Metrics are also available in Observability Plus.

More resources

Last updated June 16, 2026


Bot Management

Was this helpful?

Cross-link map: BotID (/docs/botid)From the Vercel docs graph (built 2026-09-21T05:26:59.511Z), spanning vercel.com docs + KB, nextjs.org, ai-sdk.dev, and other Vercel documentation sites. Full graph as JSON: https://vercel.com/docs/graph.jsonSemantically closest pagesHow to protect your AI endpoints with Vercel BotID — Gate every request to your AI endpoints with Vercel BotID and checkBotId\(\) so inference runs only for verified callersDeploying and testing BotID — This guide gives an overview on Vercel BotID and how to deploy and test it in production​Introducing BotID, invisible bot filtering for critical routesVercel BotID vs Cloudflare Turnstile — Compare Vercel BotID and Cloudflare Turnstile for bot protection, including detection model, hosting requirements, checkAdvanced BotID Configuration — Fine-grained control over BotID detection levels and backend domain configurationThis page links to (8)Advanced BotID Configuration — Fine-grained control over BotID detection levels and backend domain configurationForm Submissions — How to properly handle form submissions with BotID protectionGet Started with BotID — Step-by-step guide to setting up BotID protection in your Vercel projectLocal Development Behavior — How BotID behaves in local development environments and testing optionsHandling Verified Bots — Information about verified bots and their handling in BotIDObservability Plus — Learn about using Observability Plus and its limits.Firewall concepts — Understand the fundamentals behind the Vercel Firewall.Firewall Observability — Learn how firewall traffic monitoring and alerts help you react quickly to potential security threats.Pages that link here (24)By site: vercel-changelog (4) · vercel-kb (10) · vercel-shop (1) · vercel-web (6) · vercel-docs (3)From vercel-changelogImproved fake hardware detection with Vercel BotIDVercel BotID now 
available for all frameworksVercel BotID is now generally availableVercel BotID now leverages Vercel's verified bot directoryFrom vercel-kbApplication authentication on Vercel — Secure application authentication on Vercel across layers: proxy checks, the Data Access Layer, PPR-safe rendering, andBuilding AI apps on Vercel: an overview — Learn the key AI concepts and tools for building and scaling AI apps.How to Effectively Load Test Your Vercel Application — Learn how to safely load test your Next.js app on Vercel. This guide covers realistic, policy-compliant testing of routeHow to protect your AI app from bots — Learn how to protect your AI app from bots, scrapers, and abuse using Firewall, BotID, and more.How to Utilize Vercel’s Bot Management Features — A practical, step-by-step guide to identifying unwanted automated traffic and securing your Vercel apps with Bot ProtectHow to protect your AI endpoints with Vercel BotID — Gate every request to your AI endpoints with Vercel BotID and checkBotId\(\) so inference runs only for verified callersVercel BotID vs Cloudflare Turnstile — Compare Vercel BotID and Cloudflare Turnstile for bot protection, including detection model, hosting requirements, checkVercel vs Akamai — A detailed guide to Vercel vs Akamai: compute models, AI infrastructure, framework support, media streaming, CDN capabilVercel vs Northflank — A detailed guide to Vercel vs Northflank: Fluid compute, CDN and caching, container image functions, security defaults,Vercel vs Railway — A detailed guide to Vercel vs Railway: serverless vs always-on containers, container images via Dockerfile.vercel, frameFrom vercel-shopShop Configuration — Choose optional storefront features and set your store's identity and locale.From vercel-webBillions of requests: Black Friday-Cyber Monday 2025BotID Deep Analysis catches a sophisticated bot network in real-timeBotID uncovers hidden SEO poisoning​Introducing BotID, invisible bot filtering for critical routesProtecting against token theftVercel collaborates with OpenAI for GPT-5 launchFrom vercel-docsvercel firewall — Learn how to explore firewall traffic and manage your project's custom firewall rules, managed bot rules, IP blocks, sysGlossary — Learn about the terms and concepts used in Vercel's products and documentation.Products — Browse Vercel products for building, deploying, securing, observing, and scaling web applications.

Next

Get Started with BotID