Bots and AI agents

Not all automation is abuse. AI agents now sign up, start trials and claim credits for real people, and blocking every one of them turns away real customers. AbuseZero tells the two apart on every evaluation, in the same call that checks the claim.

Agents that can prove who they are show up as recognized agents, by name. You decide, benefit by benefit, which ones may claim it. Automation that hides what it is gets no pass. It's assessed alongside identity, device, network and benefit-history signals, and your policy decides the outcome.

All of this runs inside the evaluation's time limit. Your server makes one call and gets one answer: allow or deny.

Why it mattersCopy Anchor Link

Scripted sign-ups are how one person turns a single trial into hundreds. Blanket bot blocking stops them, but it also stops the browser assistants and AI agents your real customers increasingly rely on. AbuseZero Automation Defense lets you be strict with the first and welcoming to the second, per benefit.

Key capabilitiesCopy Anchor Link

• Automation assessed on every evaluation. Automation is one of the five signal families, assessed together with the others inside the evaluation's time limit.
• A bot check at the moment of submission. When your page runs a bot check as the person submits, AbuseZero verifies it during the evaluation. A check is valid only for its own claim and for a short time.
• Verified AI agents. Your server verifies an incoming agent request with one SDK call. AbuseZero then recognizes the agent by name during the evaluation.
• Allow verified agents. A recognized agent gets special treatment only on the benefits where you allowed it.
• Rules apply to agents. Verified agents you allowed skip the benefit's automation setting, but your rules, lists and eligibility apply to them like anyone else. An agent is automation, so a custom rule on automation.detected matches recognized agents too.

ConfigurationCopy Anchor Link

Each benefit has three automation settings, in the dashboard under Policies → Automation or in the benefit's config:

Add a bot checkCopy Anchor Link

In the browser, call prepareBotObservation instead of observe when the person submits. Send its deviceToken with the evaluation within 2 minutes.

import { prepareBotObservation } from "abusezero/browser";

const { deviceToken } = await prepareBotObservation({ key: "pk_…", claimId });

When bot_evidence is required and the evaluation has no usable bot check, the evaluation returns an error instead of a result:

Evaluations that carry evidence from a verified agent you allowed don't need a bot check. See Add a bot check.

Recognize verified agentsCopy Anchor Link

On your server, verify the incoming request with verifyAgentRequest, then send the result with the evaluation as agent_evidence:

import { AbuseZero, verifyAgentRequest } from "abusezero/server";

const abusezero = new AbuseZero({ key: process.env.ABUSEZERO_SECRET_KEY!, outage: "throw" });

export async function POST(request: Request) {
  const { email, claimId, deviceToken } = await request.clone().json();
  const agentEvidence = await verifyAgentRequest(request, claimId, "https://app.example.com");

  const evaluation = await abusezero.evaluate(
    {
      benefit: "pro_trial",
      claim_id: claimId,
      subject: { email },
      identifiers: { device_token: deviceToken },
      agent_evidence: agentEvidence,
    },
    `claim:${claimId}`,
  );
  // Act on evaluation.result
}

• Pass the incoming request, the claim's ID and your site's public origin.
• Send the returned AgentEvidence token unchanged. It is opaque and bound to that claim. Evidence for another claim is refused with AGENT_EVIDENCE_SCOPE.
• Verify and evaluate while handling the same request. Agent evidence is short-lived.
• Requests from people return evidence too. Always send it. AbuseZero handles both.

See Verify AI agents.

Programmatic accessCopy Anchor Link

Response dataCopy Anchor Link

• The evaluation's evidence and the dashboard show the automation family, with an assessment of clear, elevated, high or unavailable.
• When AbuseZero Automation Defense decides a claim, the reason code is automation: "AbuseZero Automation Defense detected automated activity."
• GET /v1/agents lists the agents AbuseZero recognizes. Each has an id for allowed_agents and a display name.

Next stepsCopy Anchor Link