Choose Your Integration
Pick the right Checkpoint integration for your stack — Detect traffic, Enforce policies, or Govern AI agent access
Checkpoint offers three approaches to managing AI agent traffic: Detect (observe), Enforce (block), and Govern (authorize). You can start with one and layer on more as your needs evolve — most integrations take under 10 lines of code.
All Methods at a Glance
Start with Detect. Detection-only integrations (Pixel, Beacon) log AI agent visits without blocking anything — zero risk, instant visibility — before you decide what to enforce.
| Method | Pillar | Integration | Sees | Overhead | Best For |
|---|---|---|---|---|---|
| Marketing Pixel | Detect | Script tag / GTM | JS-executing browsers | None — async, off-path | No-code, marketing teams |
| Beacon SDK | Detect | npm | JS-executing browsers, richer signals | None — async, non-blocking | SPAs, static sites |
| Gateway | Detect + Enforce | DNS CNAME | Every request to your domain | In-path at the edge | Any origin, zero code changes |
| Middleware | Detect + Enforce | npm (Next.js / Express) | Every request reaching your server | In-request | Server-side, auth routes |
| KYA-OS | Govern | Dashboard or self-host | Authenticated agent identity | In-process | API providers, SaaS platforms |
Methods are composable. You can run Pixel, Middleware, and Govern simultaneously — they share the same dashboard and detections are automatically deduplicated.
Enforce — Protect Your Application
Enforcement lets you block, redirect, or challenge AI agents based on policies you define in the dashboard.
Gateway
DNS CNAME — zero application code
- Works with any origin (Node, Python, Go, static)
- Enforcement at the edge, before traffic reaches your origin
- No deploy required to update policies
Middleware
npm package — full server-side control
- Next.js and Express SDKs
- Access to auth, session, and request context
- Custom response logic per route
Both methods share the same policy configuration — switch from observe to enforce by changing a single setting.
Govern — Authorize Verified AI Agents
Govern is for API providers and SaaS platforms that want to give verified AI agents controlled access instead of blocking them outright. Powered by the KYA-OS protocol, it lets you define what agents can do, how they authenticate, and what data they can reach.
| Auth Method | Best For |
|---|---|
| Consent Only | First-party agents, low-risk actions |
| OAuth | Third-party agents, user-facing apps |
| Custom Provider | Enterprise SSO, internal tools |
| Credentials | Legacy systems, API key auth |
Deploy via one-click in the Dashboard or self-host for full control. See the migration guide if you already have an MCP server.
Choose by Scenario
Goal: See which AI agents are visiting your site.
Recommended: Marketing Pixel or Gateway (observe mode)
The Pixel deploys through GTM with no code changes. If you want coverage for non-JS agents too, point your DNS at the Gateway instead. Both feed into the same dashboard.
Goal: Detect and block AI agents on server-rendered routes.
Recommended: Middleware (enforce mode) + Beacon for client-side coverage
Middleware protects server routes and API endpoints. Add Beacon on the client for browser-fingerprint signals. Together they cover both surfaces: every request that reaches the server, plus client-side signals from JS-executing browsers.
Goal: Protect API endpoints from unauthorized AI scraping.
Recommended: Gateway or Express Middleware
Gateway works with any backend language via DNS — no SDK needed. If you run Express/Node, the middleware gives you per-route control with access to request context.
Goal: Let verified AI agents access your platform on your terms.
Recommended: Govern (KYA-OS) + Middleware or Gateway for enforcement
Govern handles agent identity, consent, and scoped permissions. Pair it with enforcement so unverified agents are blocked while approved agents get structured access.
Goal: Maximum coverage with multi-layer defense.
Recommended: Gateway + Middleware + Govern
Gateway catches traffic at the edge. Middleware adds server-side analysis with auth context. Govern provides identity verification for approved agents. All three report to the same dashboard with automatic deduplication.
Progressive Adoption
Most teams start with Detect to understand their AI agent traffic — the Pixel or Beacon takes minutes to deploy and carries no risk. Once you see what's hitting your site, switch to Enforce to block unwanted agents. The upgrade is a config change, not a new integration: define your policies in the dashboard, then flip your middleware to enforce mode (or promote your gateway rules from log to a real verdict).
When you're ready to go further, Govern lets you move from "block everything" to "authorize the right agents." Verified agents authenticate, agree to terms, and access only what you permit — turning adversarial traffic into a controlled channel.
Next Steps
- Quick Start — Deploy your first integration in 5 minutes
- Detect — Deep dive into detection methods
- Enforce — Set up active enforcement
- Govern — Authorize AI agents with KYA-OS
- Dashboard — Monitor and analyze agent traffic