Where the request actually came from
Address reputation, network ownership and routing, resolved in memory on the edge. No lookup in your request path, and no dependency on a feed being awake.
Design partnersPilot programme open — 2026
Know who is really
on your site.
kavra separates your customers from the automation pretending to be them — and does it without a puzzle, a checkbox or a single thing for a real person to solve.
- Invisible to every legitimate visitor
- One script tag, served from your own domain
- Every decision keeps the evidence behind it
What it is built to hold
<50 ms
Added to a page load, on the visitor's critical path.
4 layers
Network, transport, browser runtime and their agreement.
0 puzzles
Nothing for a customer to read, solve or fail.
90 days
Every decision replayable, with the reasoning intact.
The platform
One integration. Four layers of evidence.
Automation can imitate any one signal. What it cannot do is make all four agree — because the layers below the browser are chosen by the operating system and the network, not by the script pretending to be a customer.
The handshake a script cannot rewrite
How a client opens a connection is decided by its operating system and its TLS stack. It is the hardest part of a visitor to fake, and it is settled before a single byte of your page is served.
What the browser says about itself
Device, rendering and environment, collected in a few kilobytes with no framework and no dependency. Treated as a claim, never as proof — which is exactly what it is.
Whether the four tell the same story
The layer competitors do not have. A client whose easy-to-forge evidence exonerates its hard-to-forge evidence has told us something about itself that no single layer could.
The cost of a puzzle
Everyone pays the toll except the traffic it was built to stop.
A challenge is a tax on your funnel. Real customers pay it in seconds and abandoned carts; the people who find it hardest pay the most. The automation it was meant to stop has been buying its way past for years, at a fraction of a cent a solve.
- Solving services price a puzzle below a tenth of a cent
- Screen readers and low vision users fail it first
- A blocked customer rarely tells you — they just leave
Use cases
Protect the actions, not the pages.
Protection is configured per action. A page view can be cheap and permissive while a payment is strict, and both are the same integration and the same signed token.
Fake signups and free-tier farming
Disposable accounts are the first step of almost everything that comes after them.
Credential stuffing at scale
Run from residential proxies, which is what makes rate limiting useless against it.
Card testing and inventory scalping
The automated buying that empties a limited drop before a customer finishes reading it.
Scraping and price harvesting
Competitors lifting your catalogue continuously, from thousands of addresses.
Spam and review manipulation
The abuse that costs trust rather than money, and takes far longer to win back.
Your own endpoints
Server-side verification for the calls your app makes, with the same token and audit trail.
Why kavra
A score you cannot question is a score you cannot defend.
Bot defence has settled on handing you a number and asking you to trust it. That is fine until a customer complains, a colleague disagrees, or somebody with authority asks why a person was refused.
Replayable
Every decision records the exact versions of the rules that made it, so it can be re-read as it was — not as today's settings would judge it.
Honest about doubt
"Low risk" and "we could not see much" are different answers. You get both, and your policy decides what to do about the second.
Yours to decide
We return confidence and reasons. Whether that is enough for a payment is a question about your business, and we do not answer it for you.
Unfamiliar is not hostile
A device nobody has seen before raises a question, not an accusation. New hardware and minority browsers are customers.
For developers
An afternoon to install. Nothing to operate.
A few kilobytes in the browser, and one signature check on your server. There is no call to us in your request path, which means there is no outage of ours that can take your checkout down with it.
- Served from your own subdomain — one origin for your CSP
- Tokens are short-lived, action-scoped and origin-bound
- Verified offline against published keys, in any language
- No cookies required, no cross-site identifiers, nothing sold
<!-- One tag, on your own subdomain. --> <script src="https://p-7f3k9m2qw8xz.k-collector.site/v1/bootstrap.js" async></script> <!-- Send the token with the action you want protected. --> const token = await window.kavra.verify({ action: 'checkout' }); await fetch('/api/checkout', { method: 'POST', headers: { 'X-Kavra-Token': token }, body: JSON.stringify(order), });
import { verify } from '@kavra/verify'; // Public keys, fetched once and cached. No call to us in the path. const claims = await verify(req.headers['x-kavra-token'], { jwksUrl: 'https://p-7f3k9m2qw8xz.k-collector.site/.well-known/jwks.json', projectId: process.env.KAVRA_PROJECT_ID, action: 'checkout', }); // Throws on anything wrong: expired, replayed, another project, // another action, another origin. Reaching here is the guarantee. placeOrder(req.body);
use Kavra\Verifier; $claims = (new Verifier( jwksUrl: 'https://p-7f3k9m2qw8xz.k-collector.site/.well-known/jwks.json', projectId: getenv('KAVRA_PROJECT_ID'), ))->verify($request->header('X-Kavra-Token'), action: 'checkout'); // $claims carries confidence and the audit ids — never the // reasoning. What moved a score is not a client's business. Order::place($request->validated());
The alternative
What changes when nobody has to prove anything.
| Image & checkbox CAPTCHA | kavra | |
|---|---|---|
| What the customer does | Solves a puzzle, sometimes twice | Nothing at all |
| Cost to an attacker | A fraction of a cent per solve | Rebuilding a browser they do not control |
| Accessibility | A known barrier for screen readers and low vision | Nothing to see, nothing to operate |
| When it gets one wrong | A number, and no way to ask why | The evidence, kept and replayable |
| If the service is down | Your form is blocked | Your backend verifies offline against public keys |
| Granularity | One setting for the whole site | Per action — a page view and a payment differ |
Questions
The ones worth asking first.
If yours is not here, an engineer will answer it directly — not a form that routes to one in a fortnight.
Do you track my users across the internet?
No. Everything is scoped to your project — an identifier from one customer's site means nothing on another's, by construction rather than by policy. No advertising identifiers, nothing sold or shared, and the browser script needs no cookie to work.
What happens to a real customer you get wrong?
They are never shown a wall. Ambiguity produces a quiet additional check rather than a rejection, and the decision to refuse anything is always yours — we return confidence and reasons, your policy decides. When you need to know why, the evaluation is there to open.
Will it slow my page down?
A few kilobytes, loaded asynchronously, blocking nothing. Verification finishes while the page is still rendering, and your server's check is a signature verification against a cached public key.
What if kavra goes down?
Your backend keeps verifying tokens it already holds, offline, against published keys. New sessions degrade to whatever your policy says they should — you choose whether an unverified visitor is refused or let through, rather than inheriting our opinion of it.
How is this different from a bot score?
A score compresses everything that happened into one number and throws the rest away. We keep the rest: which checks contributed, how confident each was, how much of the picture was missing, and which versions of which rules produced the answer.
Can I run it on my own domain?
Yes. Every project starts on a subdomain of ours and can move to a hostname of your own with a CNAME, with certificates issued and renewed for you. One origin for your content security policy either way.
Take the puzzle out of your funnel.
We are onboarding a small number of design partners. You bring a real abuse problem; we bring the platform and the attention that comes with being early.