Bot & Automation
Detection.

A drop-in <script> sensor collects behavioral signals (mouse dynamics, first-interaction timing, keystroke cadence), automation tells (navigator.webdriver, headless UAs, ChromeDriver/Selenium/Puppeteer globals), and a device fingerprint (WebGL, canvas, hardware) — then hands your app a signed, short-lived token.

The decision is made server-side, never in the browser, so an attacker who strips the script or fakes a score gains nothing. We even detect the evasion: patched native functions, tampered webdriver descriptors, and Playwright bindings leaking through toString().