Where SaaS gets attacked.
The signature SaaS attack is mass enumeration via valid API keys — caught by behavioral signals, not naive IP rate limits.
API abuse
Free-tier scrapers burn quota. Competitor data harvesting. Internal tools accidentally DOS'ing prod. Identify by key, IP, ASN, and behavioral pattern — throttle the bad, protect the good.
Credential stuffing
Botnets test leaked password dumps against your /login at 500 RPS. Cluster detection catches the slow-drip campaigns that single-IP rate limits miss.
Account takeover
Once credentials are validated, professional scrapers harvest user data via your API. Behavioral signals catch the shift from human session to bot session in real time.
Data exfiltration
Compromised user accounts paginate through everything they can see. Detect anomalous query patterns: /users?cursor=..., /search?q=*, /export endpoints under abnormal load.
Three lines, every route.
Server-side SDK in eight languages. Wrap your route handler. Get a score. Decide what to do with it.
Instrument your API
Install the server-side SDK (Node, Python, Go, Ruby, Java, PHP, .NET, Rust). Wrap your routes. Three lines of code per route.
Score every request
Each call gets a bot score 0.0–1.0 with full signal breakdown. Block, challenge, throttle, or just log — your call.
Tune in production
Per-endpoint thresholds. Step-up auth for sensitive routes. Logging mode for new policies before flipping them to block.
A scraping campaign disguised as a free-tier integration.
A free-tier API key paginates through /users 4,200 times in a minute, with no UI interaction, from an AWS datacenter. Each individual request looks normal. The behavioral fingerprint gives it away.
- API keykey sk_pub_xyz123 — free tier+0.10
- PatternGET /users?cursor=... × 4,200 in 60s+0.40
- Behaviorno UI interaction events+0.25
- ASNAWS datacenter (verified)+0.30
- Bot scoreCapped at 1.0 — blocked1.00
Built for API-first products.
Per-endpoint policies
Tight thresholds on /admin/*, /users/*, /export. Loose on /pricing, /docs. Configurable per route, per HTTP method.
API key reputation
Track score per API key across days. Auto-suspend keys with sustained bot-score patterns. Manual override for partners.
Per-key rate limits
Token bucket per key. Burst-tolerant for chatty integrations, strict for free-tier scraping prevention. Configurable in dashboard.
Step-up auth triggers
Sensitive routes (transfers, exports, profile edits) require fresh re-auth when score sits in the suspicious band. Invisible for trusted sessions.
OWASP API top 10
Built-in detection for BOLA, broken auth, excessive data exposure, mass assignment, security misconfig — beyond simple bot detection.
Audit-ready logs
Per-request trail with score, signals, full headers, geo, ASN, decision. SOC 2 + ISO 27001 friendly export.