Arcjet

Arcjet is a security-as-code platform for developers, delivering rate limiting, bot detection, email validation, sensitive-information detection, and a Shield WAF as building blocks embedded directly in application code via SDKs. The SDK is the primary interface; it runs a local WebAssembly analysis module and calls Arcjet's Decide service - a Connect/gRPC (protobuf) decision API at decide.arcjet.com - for stateful decisions like rate limiting and advanced bot detection.

7 APIs 0 Features

SecurityRate LimitingBot DetectionWAFDeveloper Security

APIs

Arcjet Decide API

The core Connect/gRPC decision service (proto.decide.v1alpha1.DecideService, Decide and Report RPCs) that the Arcjet SDK calls for stateful security decisions. ConnectRPC suppor...

Arcjet Rate Limiting

Token-bucket, fixed-window, and sliding-window rate limiting configured as code and enforced through the SDK, with cross-request state tracked by the cloud Decide service. Limit...

Arcjet Bot Detection

Identifies and classifies automated clients, allowing or denying known bots by category. Basic identification runs locally in the SDK WebAssembly module; advanced bot signals ar...

Arcjet Email Validation

Validates email addresses for syntax, deliverability, disposable and no-MX-record domains, and free providers, used to block fake or fraudulent signups. Invoked through the SDK ...

Arcjet Sensitive Information Detection

Detects PII and other sensitive data (emails, phone numbers, credit cards, IP addresses, or custom patterns) in request bodies. Detection runs locally in the SDK WebAssembly mod...

Arcjet Shield WAF

WAF-like protection against common attacks such as SQL injection, cross-site scripting, and other OWASP-style threats, applied to requests flowing through the SDK and evaluated ...

Arcjet SDKs

The primary, supported interface to Arcjet. SDKs ship for Node.js, Next.js, Bun, Deno, SvelteKit, NestJS, Remix, Astro, React Router, Fastify, and Python, each wrapping the Conn...

Collections

Arcjet Decide API

OPEN

Pricing Plans

Arcjet Plans Pricing

5 plans

PLANS

Rate Limits

Arcjet Rate Limits

4 limits

RATE LIMITS

FinOps

Arcjet Finops

FINOPS

Resources

👥

GitHubOrganization

Sources

opencollection: 1.0.0
info:
  name: Arcjet Decide API
  version: v1alpha1
  description: SDK-first security-as-code platform. The production interface is the Connect/gRPC Decide service (proto.decide.v1alpha1.DecideService)
    at decide.arcjet.com. ConnectRPC supports gRPC over HTTP/2 and an HTTP/1.1 + JSON POST fallback to the same RPC paths,
    modeled here. The Arcjet SDK is the supported interface; these requests are for reference.
request:
  auth:
    type: apikey
    key: Authorization
    value: '{{arcjetKey}}'
    in: header
items:
- info:
    name: Decide
    type: folder
  items:
  - info:
      name: Make a security decision for a request.
      type: http
    http:
      method: POST
      url: https://decide.arcjet.com/proto.decide.v1alpha1.DecideService/Decide
      body:
        type: json
        data: "{\n  \"sdkStack\": \"NODEJS\",\n  \"sdkVersion\": \"1.0.0\",\n  \"characteristics\": [\"ip.src\"],\n  \"details\"\
          : {\n    \"ip\": \"203.0.113.10\",\n    \"method\": \"POST\",\n    \"host\": \"example.com\",\n    \"path\": \"\
          /api/login\",\n    \"headers\": {}\n  },\n  \"rules\": []\n}"
    docs: Connect RPC Decide method. The SDK sends request details and configured rules; the service returns a decision (ALLOW,
      DENY, CHALLENGE, ERROR). Native transport is gRPC over HTTP/2; the HTTP/1.1 + JSON POST equivalent is shown.
  - info:
      name: Report a decision made locally by the SDK.
      type: http
    http:
      method: POST
      url: https://decide.arcjet.com/proto.decide.v1alpha1.DecideService/Report
      body:
        type: json
        data: "{\n  \"sdkStack\": \"NODEJS\",\n  \"sdkVersion\": \"1.0.0\",\n  \"details\": {\n    \"ip\": \"203.0.113.10\"\
          ,\n    \"method\": \"POST\",\n    \"host\": \"example.com\",\n    \"path\": \"/api/login\"\n  },\n  \"decision\"\
          : {\n    \"id\": \"abc123\",\n    \"conclusion\": \"ALLOW\"\n  },\n  \"rules\": []\n}"
    docs: Connect RPC Report method. When the SDK reaches a decision locally in its WebAssembly module, it asynchronously
      reports that decision to Arcjet for dashboard visibility and state.