# Korzen

> Korzen Bot Protection tells a customer's server, in one call, whether a visitor is a person or a bot, before a sign-up, a sign-in or a checkout. No proxy, fail-open.

## Docs

- [Set-up guide for coding agents](https://korzen.dev/bot-protection/docs/setup.md): add Bot Protection to a project, step by step
- [Quickstart](https://korzen.dev/bot-protection/docs/quickstart.md): Bot Protection in three steps: the tag on your pages, one call from your server, and monitor mode until you trust it.
- [Set up with AI](https://korzen.dev/bot-protection/docs/setup-with-ai.md): One prompt for Claude Code, Codex, Cursor or any coding agent: it adds the tag and the call from your server, in monitor mode, and shows you the diff.
- [The tag](https://korzen.dev/bot-protection/docs/tag.md): The script on your pages: where it goes, the cookie it leaves, its options and how it learns your domains.
- [The call from your server](https://korzen.dev/bot-protection/docs/server-call.md): POST /v1/decide before a sign-up, a sign-in or a checkout: what to send, what comes back, and code for Next.js, Express, Go and Python.
- [Monitor and block mode](https://korzen.dev/bot-protection/docs/modes.md): Every account starts in monitor mode: see what Bot Protection would stop, then turn on block mode and choose each class's action.
- [Feedback](https://korzen.dev/bot-protection/docs/feedback.md): Tell Bot Protection what you learned later, a verified customer or a chargeback, so the next decisions for that browser are better.
- [Plans and limits](https://korzen.dev/bot-protection/docs/plans-and-limits.md): What counts as a decision, the free trial, what happens at your plan's limit, the spend limit, and what a domain is.
- [Next.js](https://korzen.dev/bot-protection/docs/nextjs.md): Bot Protection in a Next.js App Router project: the tag in the root layout, the call in a server action, the visitor's IP on Vercel and behind a proxy.
- [Express](https://korzen.dev/bot-protection/docs/express.md): Bot Protection in an Express app: the tag, the call with Node's fetch, trust proxy for the visitor's IP, and the route that creates the account.
- [Fastify and NestJS](https://korzen.dev/bot-protection/docs/fastify-nestjs.md): Bot Protection in Fastify or NestJS: the tag, the client file, a preHandler hook in Fastify, the Express middleware in NestJS, and the visitor's IP.
- [Web-standard Request](https://korzen.dev/bot-protection/docs/web-request.md): Bot Protection in Hono, Bun, Deno, React Router and Remix, Astro, SvelteKit and Nuxt: one client file, fromRequest on the Fetch API's Request, and the visitor's IP on each.
- [Django and Flask](https://korzen.dev/bot-protection/docs/django-flask.md): Bot Protection in Django or Flask: the tag in the base template, one module for the call with requests, and the visitor's IP behind a proxy.
- [FastAPI](https://korzen.dev/bot-protection/docs/fastapi.md): Bot Protection in FastAPI: the tag, one module for the call with httpx under one timeout, the headers' order from the ASGI scope, and uvicorn behind a proxy.
- [Rails](https://korzen.dev/bot-protection/docs/rails.md): Bot Protection in Rails: the tag in the layout, the call with Net::HTTP and a connection kept open, request.remote_ip, and Devise.
- [Laravel](https://korzen.dev/bot-protection/docs/laravel.md): Bot Protection in Laravel: the tag in the layout, the _kz cookie left unencrypted, trusted proxies, and the call with Laravel's HTTP client.
- [PHP and Symfony](https://korzen.dev/bot-protection/docs/php.md): Bot Protection in PHP without a framework or with Symfony: the tag, one class for the call with curl under one timeout, the headers' order, and trusted proxies.
- [Go net/http](https://korzen.dev/bot-protection/docs/go.md): Bot Protection in a Go server with net/http alone: one client for the process, the whole call under one timeout, and the visitor's IP.
- [Spring Boot](https://korzen.dev/bot-protection/docs/spring-boot.md): Bot Protection in Spring Boot: the tag, one component for the call with RestClient under one timeout, Tomcat's forwarded headers for the visitor's IP, and the controller.
- [ASP.NET Core](https://korzen.dev/bot-protection/docs/aspnet-core.md): Bot Protection in ASP.NET Core: the tag, one class for the call with one HttpClient under one timeout, the forwarded headers middleware for the visitor's IP, and the endpoint.
- [Cloudflare Workers](https://korzen.dev/bot-protection/docs/cloudflare-workers.md): Bot Protection in a Cloudflare Worker, in front of your origin: the decision at the edge, CF-Connecting-IP, and the request on to your app.
- [Kubernetes](https://korzen.dev/bot-protection/docs/kubernetes.md): Bot Protection from an app on Kubernetes: the API key as a Secret, the visitor's IP through the load balancer and ingress-nginx, and egress.
- [Widgets on other sites](https://korzen.dev/bot-protection/docs/widgets.md): A widget your customers embed on their own sites, as a booking form, a shop or a ticket box: the tag in its frame, the token your page sends, and which domains count.
- [Supabase Auth](https://korzen.dev/bot-protection/docs/supabase.md): Bot Protection with Supabase Auth: sign-ups through your server, and a Before User Created hook that refuses the ones that skipped it.
- [Clerk](https://korzen.dev/bot-protection/docs/clerk.md): Bot Protection with Clerk: one decision on a new account's first page, a ban on block, and a mark in the session token your app checks.
- [Auth0](https://korzen.dev/bot-protection/docs/auth0.md): Bot Protection with Auth0: a pre-user-registration Action that asks before the user is created, and what it can and cannot see.
- [Better Auth](https://korzen.dev/bot-protection/docs/better-auth.md): Bot Protection with Better Auth: a database hook that asks before any user is created, with a password or a social provider, and refuses the sign-up on block.
- [Every docs page in one file](https://korzen.dev/llms-full.txt)
- [OpenAPI description of the API](https://korzen.dev/openapi.json)

## Optional

- [Pricing](https://korzen.dev/bot-protection/pricing)
- [Bot Protection vs DataDome](https://korzen.dev/bot-protection/compare/datadome): DataDome sits in front of every request and blocks bots itself, on annual contracts; Bot Protection answers your server at the actions you choose, self-serve. When each fits.
- [Bot Protection vs Fingerprint](https://korzen.dev/bot-protection/compare/fingerprint): Fingerprint recognizes the same device across visits; Bot Protection judges each request as a person or a bot. They answer different questions, and work well together.
- [Bot Protection vs hCaptcha](https://korzen.dev/bot-protection/compare/hcaptcha): hCaptcha is a challenge people solve, free on its Basic plan; Bot Protection decides without one. When each fits, and hCaptcha as Bot Protection's challenge.
- [Bot Protection vs Google reCAPTCHA](https://korzen.dev/bot-protection/compare/recaptcha): reCAPTCHA scores each action from 0.0 to 1.0 on Google Cloud; Bot Protection gives a decision with reasons from servers in the EU. Prices at volume, and when each fits.
- [Bot Protection vs Cloudflare Turnstile](https://korzen.dev/bot-protection/compare/turnstile): Turnstile is a free challenge widget that answers yes or no; Bot Protection answers with a decision and its reasons, without a widget. When each fits, and how they work together.
- [Terms of Service](https://korzen.dev/legal/terms): The agreement between your company and Korzen for Bot Protection: the service, your account, payment through Paddle, and our responsibilities.
- [Privacy Policy](https://korzen.dev/legal/privacy): What personal data Korzen collects, why, who receives it, how long we keep it, and your rights under GDPR, LGPD and US state laws.
- [Refund Policy](https://korzen.dev/legal/refund): A full refund within 14 days of a purchase, how to ask for one, and what happens after you cancel.
- [Cookie Policy](https://korzen.dev/legal/cookies): The few cookies this site needs, none for advertising or analytics, and what Bot Protection stores, on our own account pages and on our customers' sites.
- [Data Processing Agreement](https://korzen.dev/legal/dpa): How Korzen processes your visitors' personal data for you, under GDPR article 28 and Brazil's LGPD, with the security measures and the subprocessors.
- [Subprocessors](https://korzen.dev/legal/subprocessors): The companies that process personal data for Korzen, what each does and where.