LayerSift
Start free

Bot detection · device intelligence

Every request, sifted layer by layer.

One API call reads the network a visitor arrives on, the device it runs and the way it behaves. Bots stop at the layer that gives them away, and every decision says why.

Start free trialRead the docs
  • 14 days free, no card
  • $49 a month for 20,000 identifications
  • Data kept in the EU

Identifying this browser…

Locating…

Your visitor ID

Reading the network, the device and the behavior…

  1. Network

  2. Device

  3. Behavior

Suspect score
The full response

15 SDKs and integrations

  • Node
  • Python
  • Ruby
  • PHP
  • Java
  • Go
  • .NET
  • iOS
  • Android
  • Flutter
  • React Native
  • React
  • Vue
  • Svelte
  • Angular

How it works

Three layers. A bot has to fool all of them.

A bot can fake one thing at a time: a user agent, a screen, a mouse path. LayerSift reads each layer on its own and checks it against the others, so a lie told at one layer shows at the next.

An illustration. The reasons are the engine's own codes, as your server reads them.

  1. 01

    Network

    The TLS handshake (JA4, JA3) and the HTTP/2 settings, read where TLS ends, and the address with its history: VPNs, residential proxies, Tor exits, hosting ranges.

    Stops here

    • HTTP libraries posing as Chrome
    • Proxy and hosting farms
    • Replayed cookies

    For example ja4ImplausibleForUa

  2. 02

    Device

    A visitor ID that survives cleared cookies and incognito, and a browser checked against the engine that made it: automation globals, driver artefacts, patched functions, private windows, virtual machines.

    Stops here

    • Headless Chrome
    • Puppeteer, Playwright, Selenium
    • Anti-detect browsers
    • Virtual machines

    For example engineOlderThanClaimed

  3. 03

    Behavior

    How the page is driven — pointer, keys and timing — and how fast one device moves across addresses, countries and accounts.

    Stops here

    • Scripted clicks and typing
    • Credential stuffing
    • Sign-up and promo abuse

    For example velocity:accountsFromDevice

For developers

Decided on your server, not believed in the browser.

Whoever owns a browser can edit what it reports. So the browser only carries an id, your server reads the event with its secret key, and the decision is made where no one can talk their way past it.

  • Read again with your secret key. The browser hands your server an event id; the event itself comes from us.

  • Reasons, not a black box. Every decision names the checks that made it, so you tune against your own traffic.

  • Signed webhooks. HMAC-SHA256 with replay protection on every delivery.

  • Your data, deletable. Remove one event or everything about a visitor with one call.

Getting startedServer API
1In the browsersign-up.js
const agent = await Antibot.load({ apiKey: "pk_live_…" })
const { requestId } = await agent.get()

await fetch("/api/sign-up", {
  method: "POST",
  body: JSON.stringify({ requestId, email }),
})
2On your serverapi/sign-up.js
import { AntibotClient } from "@antibot/node-sdk"

const antibot = new AntibotClient({
  apiKey: process.env.ANTIBOT_SECRET_KEY,
})
const event = await antibot.getEvent(requestId)

if (event.products?.bot.result === "bad") return deny()
if (event.suspectScore >= 70) return challenge()
return allow(event.visitorId)
3A real answer, to a script dressed as Chromeverdict
{
  "action": "challenge",
  "score": 50,
  "reasons": [
    "headers:contradiction",
    "headers:missingBrowserHeaders",
    "headers:missingFetchMetadata"
  ]
}

Use cases

One question behind six kinds of fraud.

Have we seen this device before, and should we trust it? LayerSift answers it in the request.

  • Payment fraud

    Recognise the device behind a card before it clears, even when the billing details are brand new.

  • New account fraud

    Catch the twentieth account from a device that already burned nineteen.

  • Account takeover

    Step up authentication only when the device does not match the account's history.

  • Credential stuffing

    Spot automation frameworks and headless browsers before the first password is tried.

  • Coupon and promo abuse

    One sign-up bonus per device, not per throwaway inbox.

  • Account sharing

    Count real devices per subscription instead of guessing from IP addresses.

Know who is on the other end.

Free for 14 days, no card. Then $49 a month with 20,000 identifications included and $2 per 1,000 after. Checks from your server and your edge cost nothing.

Start free trialSee pricing