POST a request, get a verdict.
No DNS changes, no proxy in front of your traffic, no SDK lock-in — just an HTTP endpoint your stack already knows how to call.
Bearer license key, form-encoded parameters, JSON verdict back.
Full endpoint list — domains, rules, traffic, whitelist/blacklist, stats, shortener — with an interactive tester in the docs. Client guides for PHP, Node.js, Python and cURL.
Verdicts return fast enough to sit inline in middleware. Your users never feel the check.
If ZeroBot is ever unreachable, traffic flows and the incident is logged. Your uptime is never hostage to ours. Prefer strict? Switch to fail-closed.
Form-encoded requests, Bearer auth, documented quirks and an in-page tester. Docs published in six languages.
Fingerprinting, JS validation, IP reputation, ASN, VPN/Tor/datacenter checks — composited into one verdict you can act on.
Traffic logs, stats, rules, allow/blocklists — the API covers the dashboard surface, so you can automate your whole setup.
Get a license and make real calls before paying anything. One flat plan after that — every endpoint included.
Median response latency is under 50 ms. Verdicts are designed to sit inline in your request path without visitors noticing.
ZeroBot fails open by default: your visitors get through and the incident is logged. You can switch to fail-closed if you prefer strict blocking.
Requests are form-encoded (application/x-www-form-urlencoded) with a Bearer license key in the Authorization header; responses are JSON. The docs say this up front so you never debug a silent mismatch.
Authorized domains, custom rules, traffic logs, whitelist and blacklist entries, account stats and shortener links — the full dashboard surface, with an interactive tester built into the docs.
Free tier, real verdicts, docs with a built-in tester.
Get started free →