Introduction

Checkpoint provides comprehensive protection against AI agents and automated bots accessing your web applications. Whether you're protecting valuable content, preventing scraping, or managing how AI agents interact with your services, Checkpoint provides detection, enforcement, and governance tools.

How It Works

Checkpoint uses multiple detection methods to identify automated traffic:

User Agent Analysis — Identifies known agent signatures and patterns
TLS Fingerprinting — Analyzes TLS handshake characteristics unique to automated clients
Header Analysis — Inspects HTTP headers for automation signals
Behavioral Signals — Detects interaction patterns that differ from human users
Browser Fingerprinting — Identifies characteristics unique to automated browsers (client-side)

Choose Your Approach

Checkpoint operates in three modes that you can use independently or combine:

Detect

Passive identification of AI agents and bots. No traffic is blocked — detections are logged to your dashboard for analysis.

Best for: Understanding your traffic before enforcing, analytics teams, content monitoring.

Marketing Pixel — No-code script tag for any website
JavaScript Beacon — Full SDK with WebWorker support
Middleware (observe mode) — Server-side detection without enforcement

Enforce

Active detection plus enforcement. Detected agents are handled according to your policies — blocked, redirected, or challenged for consent or cryptographic identity.

Best for: Protecting content, APIs, and application routes from unwanted automation.

Gateway — DNS-based enforcement at the edge (no code changes)
Middleware (enforce mode) — Code-level enforcement in Next.js or Express
Policies — Configure enforcement rules and thresholds

Govern (KYA-OS)

Identity-based access control for AI agents using KYA-OS. Instead of blocking agents, grant them scoped, authenticated access.

Best for: API providers, SaaS platforms, and services that want to offer structured AI agent access.

Govern Overview — Architecture and quick start
Delegations — Scoped access grants
Tool Permissions — Per-tool authorization

Core Concepts

Detection Classes

Checkpoint classifies every request into one of four classes:

Class	Description
`human`	Regular browser traffic from a human user
`ai_agent`	AI assistants like ChatGPT, Claude, Perplexity, Gemini
`bot`	Traditional bots like Googlebot, Bingbot, scrapers
`incomplete_data`	Insufficient signals for confident classification

Each detection also carries a confidence score from 0–100 — see Confidence Scores for the band table. A score of exactly 0 means the request couldn't be classified; it does not mean "confidently human."

See Core Concepts for the full mental model behind detections and verdicts, and Detect for how each detection method surfaces these classes.

Start by logging all detections, then use Analytics to review confidence distributions before setting enforcement thresholds.

Privacy & Compliance

Checkpoint is designed with privacy in mind:

GDPR compliant
Respects Do Not Track headers
Configurable data retention
No PII collection by default
IP anonymization options
30-minute client-side session rotation

Modern browsers (Chrome 90+, Firefox 88+, Safari 14+, Edge 90+)
JavaScript enabled
Optional: WebWorker support for optimal performance

Server-Side (Middleware)

Node.js 18+
Next.js 13+ (for Next.js integration)
Express 4.18+ (for Express integration)
.NET 8.0 / ASP.NET Core (for .NET integration)

Gateway

DNS access to configure CNAME records
Works with any origin server (no runtime requirements)

Next Steps

Ready to get started? Grab your API key and Project ID, then follow our Quick Start Guide to have Checkpoint running in under 5 minutes.

For deeper dives:

Detection Methods — Compare detection approaches
Enforcement — Set up active protection
Governance — Control AI agent access with KYA-OS
Dashboard — Navigate the platform

Getting Started