Request
string
The user agent. Read from
headers when omitted.Headers | Record<string, string | string[]>
Request headers, in any casing.
string | null
The real client IP. Ports and IPv4-mapped IPv6 addresses are handled. Anything that isn’t a single valid address skips verification.
Options
IpRanges
The result of
loadIpRanges(). Turns on IP verification and impersonator detection.boolean
default:"false"
Set when browser headers reach you untouched over HTTPS. Turns on the
sec-fetch-*, sec-ch-ua and Accept-Language checks.number
default:"180"
An operator’s range file older than this can still verify a request, but never flags one as an impersonator.
Date
Overrides the current time, for tests.
Returns
'agent' | 'ai-crawler' | 'crawler' | 'bot' | 'human' | 'unknown'
required
See Categories.
string
Detail within the category, such as
coding, training or http-client.string
The matched dataset entry, such as
claude-code or gptbot.string
The product’s display name.
string
The company that runs it.
string
The product version, when the user agent carries one.
boolean | null
required
true when the IP is in the operator’s published ranges, false when it provably isn’t who it claims to be, and null when it wasn’t checked or can’t be.'high' | 'medium' | 'low'
required
See Confidence.
string[]
required
Plain-English explanations of how the request was classified.