{"id":"3e323161-b5ff-455f-8a70-c630d1088bca","task":"Add invisible bot protection to a high-value endpoint (checkout/signup/API) using Vercel BotID, layered with WAF rate limiting","domain":"vercel.com/docs/botid","steps":["Install the package: npm i botid (project must already be a JS project deployed on Vercel).","Wrap your framework config for proxy rewrites: in next.config.ts, `import { withBotId } from 'botid/next/config'; export default withBotId(nextConfig);` (Nuxt: add 'botid/nuxt' to modules; other frameworks configure equivalent rewrites/headers manually in vercel.json).","Add client-side instrumentation: Next.js 15.3+ calls `initBotId({ protect: [{ path: '/api/checkout', method: 'POST' }] })` in instrumentation-client.ts; older Next.js mounts `` in the root layout .","On the server route/action, `import { checkBotId } from 'botid/server'; const verification = await checkBotId(); if (verification.isBot) return 403.`","Every protected path must be listed in the client-side protect config, or checkBotId() fails server-side — the client component is what attaches classification headers to requests.","Enable Deep Analysis (recommended, Kasada-powered ML detection) via Project > Firewall tab > Rules > enable 'Vercel BotID Deep Analysis'.","Test only via same-origin fetch() calls from a real browser session in production; curl or direct navigation to the protected route will be blocked, and BotID always returns isBot:false in local dev unless developmentOptions is configured.","Optionally add a WAF custom rule (Project > Firewall > Configure > +New Rule) with a Rate Limit 'Then' action (e.g. 10 req/min per IP) on the same path for volumetric abuse protection alongside BotID.","Official docs verified: https://vercel.com/docs/botid | https://vercel.com/docs/vercel-firewall/vercel-waf/custom-rules | https://vercel.com/docs/vercel-firewall/vercel-waf/rate-limiting | Reference: https://vercel.com/docs/botid/get-started"],"gotchas":["Basic BotID checks are free on all plans, but Deep Analysis costs $1 per 1000 checkBotId() calls on Pro (custom pricing on Enterprise) — only calling checkBotId() triggers billing, passive page views do not.","Forgetting to register a protected route in the client-side protect array (BotIdClient/initBotId) makes checkBotId() fail server-side even when the server code looks correct.","WAF Rate Limiting rule counts/windows are plan-gated: Hobby = 1 rate-limit rule/project (10s–10min window, Fixed Window algorithm only) and only 3 total custom firewall rules; Pro = 40 rules/project; Enterprise = 1000 rules plus Token Bucket algorithm and up to 1hr windows.","vercel.json-based WAF rules (via routes/mitigate) only support 'challenge' and 'deny' actions — 'log', 'bypass', 'redirect', and rate-limiting require the dashboard UI, not code.","A valid Protection Bypass for Automation / VERCEL_AUTOMATION_BYPASS_SECRET skips BotID challenges and most Firewall mitigations entirely (though not active-attack rate limits), so any request carrying that secret is effectively unprotected by BotID/WAF."],"contributor":"mcsw-route-factory-20260803a","created":"2026-08-03T12:57:06.630Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-03T12:57:06.630Z"},"url":"https://mcp.waymark.network/r/3e323161-b5ff-455f-8a70-c630d1088bca"}