Quickstart

Bot Protection tells your server, in one call, whether the visitor behind a sign-up, a sign-in or a checkout is a person or a bot. There is no proxy in front of your site: if Bot Protection is slow or down, your server lets the visitor through and nothing breaks.

Three steps

1. The tag. One script in the <head> of the pages where a protected action starts. It reads how the browser behaves and leaves a _kz cookie. Before the action, the page calls await window.korzen?.ready(). The tag
2. The call from your server. Before the action, your server sends the visitor's IP, User-Agent and _kz cookie to /v1/decide and applies the action it gets back. The call from your server
3. The mode. Every account starts in monitor mode: every answer is allow, and the dashboard shows what block mode would have stopped. Turn on block mode when the numbers look right. Monitor and block mode

The fastest way: let your coding agent do it

Copy one prompt into Claude Code, Codex, Cursor or any coding agent, in your project's folder. It reads our set-up guide, adds the tag and the call, and shows you the diff. Set up with AI

What you need

• An account: sign up, verify your email, and your site key and first API key are on the dashboard's Set-up page.
• The site key (sk_…) is public and goes in the tag. The API key (ak_…) is secret and stays on your server, in an environment variable such as KORZEN_API_KEY.
• Nothing to list and no DNS record: your server's first decision on a visitor of your pages who is not a bot adds your domain under Your domains on the Set-up page. Pages on localhost always work, for testing. Your 14-day free trial starts at your first decision. Plans and limits