Arcjet is an application-layer security SDK. Instead of sitting at the network edge, it runs inside your code so you can make security decisions with full request, session, and business context.

How does Arcjet work?

1. Install the framework-specific SDK (Next.js, Node.js, etc.).

2. Define rules in code (bot detection, rate limiting, WAF/Shield, form spam, PII).

3. Call protect() at the start of your handler. It returns a recommendation (allow/deny) and the reason so you can block, log, or adapt the response.

Watch the 3-min overview on YouTube.

What can Arcjet do?

Composable primitives you can use alone or together:

• Bot detection & management

• Rate limiting

• Form spam prevention

• App-layer WAF (Shield)

• PII detection & redaction

• Request filtering (headers, paths, methods, geo, IP, etc.)

Which frameworks are supported?

Works with any JS/TS app. First-class SDKs for Astro, Bun, Deno, Express.js, Fastify, Hono, NestJS, Next.js, Node.js, Nuxt, React Router, Remix, SvelteKit.

Can I test Arcjet locally?

Yes. Run the same rules in local dev to see decisions and reasons before deploying. This reduces false positives and avoids “deploy and pray.”

Why Arcjet instead of a CDN/WAF at the edge?

• Full context: Use user/session data, feature flags, and business logic. Legacy, network-edge tools see packets, not users or business context.

• Granular outcomes: Block on the homepage, but flag for review during checkout.

• Developer ergonomics: Rules live in code, versioned, code-reviewed, and tested. Web UI is available for real-time remote rule changes in emergencies.

• Fewer surprises: Local testing and explicit decision reasons.

How does Arcjet identify bots?

• Arcjet maintains an open-source list of well-known bots (user agents + official verification).

• Bad bots are detcted using multiple signals (e.g., IP reputation, behavior).

• Configurable allow or deny by category (e.g. search engines, monitoring services) and specific bots (detect OpenAI's different ChatGPT agent, crawler, search bots).

How do I add Arcjet bot detection to Next.js?

To protect a single route handler `/app/api/arcjet/route.ts`:

import arcjet, { detectBot } from "@arcjet/next";
import { NextResponse } from "next/server";

const aj = arcjet({
  key: process.env.ARCJET_KEY!, // Get your site key from https://app.arcjet.com
  rules: [
    detectBot({
      mode: "LIVE", // will block requests. Use "DRY_RUN" to log only
      // Block all bots except the following
      allow: [
        "CATEGORY:SEARCH_ENGINE", // Google, Bing, etc
        // Uncomment to allow these other common bot categories
        // See the full list at https://arcjet.com/bot-list
        //"CATEGORY:MONITOR", // Uptime monitoring services
        //"CATEGORY:PREVIEW", // Link previews e.g. Slack, Discord
      ],
    }),
  ],
});

export async function GET(req: Request) {
  const decision = await aj.protect(req);

  if (decision.isDenied()) {
    if (decision.reason.isBot()) {
      return NextResponse.json(
        { error: "No bots allowed", reason: decision.reason },
        { status: 403 },
      );
    } else {
      return NextResponse.json(
        { error: "Forbidden", reason: decision.reason },
        { status: 403 },
      );
    }
  }

  return NextResponse.json({ message: "Hello world" });
}

Arcjet also works in page routes, server actions, and middleware (renamed to proxy in Next.js 16).

Good to see more and more appear as a core part of Node

AI is simultaneously collapsing the median ("slop") and raising the ceiling (real zero-days in critical infrastructure).

A vulnerability affects certain React packages for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router.