Skip to main content

​
What is Fingerprint Bot Detection?

Fingerprint Bot Detection detects automated activity on your websites or API endpoints. It detects both AI tools (agents, assistants) and traditional bots. When performing bot detection, Fingerprint analyzes hundreds of browser attributes and network signals and gives you back a bot detection result with one of three values:
  • Good bot - includes several categories of bots, such as authorized AI agents, AI assistants, verified search crawlers, marketing, monitoring, and SEO optimization tools.
  • Bad bot - includes browser automation tools like Selenium, Puppeteer, Playwright, or anything that impersonates verified tools. Bad bots can take over accounts, submit spam, steal passwords, scrape data, waste resources, etc.
  • Bot not detected - the visitor is likely a human using a regular browser.
You can use the provided bot detection result to better understand your AI and human traffic or implement protective measures against malicious bots.

​
How to enable Fingerprint Bot Detection?

If you want to use Fingerprint Bot Detection, upgrade to the Pro Plus plan. If you have an Enterprise plan, reach out to your Customer Success Manager or Fingerprint support team.

​
Integrating Bot Detection

Bot detection supports two integration methods: JavaScript agent and Flow worker (does not require JavaScript). They can be used together. This section covers the JavaScript agent integration. See Flow worker integration in the Automation Intelligence API section below.

​
JavaScript agent integration

This method is ideal to detect browser automation or AI agents that orchestrate browsers. It also supports antidetect browsers, and traditional browser automation libraries, such as Playwright, Selenium, or Puppeteer. To use this integration:
  1. Add the JavaScript agent in the frontend part of your web application.
  2. Get the event_id from the JavaScript agent response and pass it to your server.
  3. Use Fingerprint Events API from your backend to retrieve the Bot Detection result. Use the information about AI tools and bots in your business logic.

​
JavaScript agent

The JavaScript agent is a client-side library that collects browser signals and sends them to the Fingerprint backend. The library returns an object with multiple fields, but for Bot detection only the event_id is needed to get the results on the backend.
Bot Detection and JavaScript agent versionsBot Detection works only with JavaScript agent version 3.7.0 or newer. Check your version and update it if needed.

​
Bot Detection results on the client side

Since the data from the client browser might be spoofed by fraudulent parties, Fingerprint strongly recommends server verification using the Server API. Bad actors can replace the event_id with a fake value or completely delete this field. Check the request timestamp returned by the Server API – it shouldn’t be older than several seconds or minutes depending on the implemented scenario. If the event_id doesn’t pass the verification, you need to ask your users for additional verification (CAPTCHA, 2FA) or deny access to the requested resource. However, the most secure way of using the Fingerprint platform is Zero Trust Mode which makes only event_id available on the frontend.

​
Native mobile libraries

Bot Detection doesn’t currently support native mobile libraries.

​
Fingerprint’s SDKs and libraries

Bot Detection is supported by all provided client and server-side libraries, but the AI tool detection results are available in server API v4 or later.

​
Automation Intelligence API: detecting automation without a browser

The Automation Intelligence API is a separate, standalone API (Public Preview) that detects the same kind of automated traffic as Bot Detection, such as AI agents, AI assistants, and AI browsers. Unlike the JS-based Bot Detection described above, it detects automation from HTTP request metadata alone, such as headers, method, URL, and IP address, with no JavaScript agent and no browser execution required. It’s also platform-agnostic: it works with any CDN provider, cloud platform, or server backend, unlike the Flow worker integration, which is Cloudflare-specific.

​
When to use which

Use JS-based Bot Detection (JS agent) when you control the frontend and want to detect browser-level automation, such as headless browsers, Selenium, Puppeteer, Playwright, or antidetect browsers, and want to combine bot detection with visitor Identification in the same request. Use the Automation Intelligence API when traffic reaches your server or edge directly over HTTP with no browser and no JavaScript execution at all, for example AI agents or assistants calling your API directly, MCP servers, or any backend-to-backend traffic, and when you want edge or pre-origin detection. JS-based Bot Detection and the Automation Intelligence API aren’t mutually exclusive: they cover different traffic (browser-executed vs. non-browser HTTP), so many teams run both. To get the best bot detection accuracy and coverage, use the Automation Intelligence API together with the JavaScript agent integration. For full request/response details, see the Automation Intelligence API reference.

​
Flow worker integration (currently in beta)

If you want to detect AI tools and bots at the edge level, use the Flow integration running on Cloudflare. Flow’s edge bot detection is built on top of the Automation Intelligence API described above. Flow workers can detect AI agents, AI assistants, and bots that access your pages and API endpoints. After enabling Edge Bot Detection, the Flow worker provides IP intelligence and bot detection data to your pages and API endpoints by setting HTTP request headers in the requests it forwards. The headers are delivered to your protected origins synchronously with each request. This method does not require the JavaScript agent and will work for all bot types.

​
Identification and Bot Detection

Fingerprint Identification and Bot Detection produce the best results when used together. A combination of Identification and Bot Detection gives you a powerful tool to prevent online fraud. Using both products is recommended. One JavaScript agent running in the browser and one event_id value to get both identification and bot detection results on the backend without additional latency.