FAQ

How much latency does this add?

One blocking call, in the request path, with a hard budget: 150 ms by default on both SDKs, and 500 ms on guided Cloudflare installs. Both are configurable. The budget is the worst case. When it's exceeded, the request passes instead of waiting. A second, non-blocking call reports the outcome after your response is already on its way, and the heavy verification work happens there, off the hot path.

What happens if D3 Edge is unreachable?

Your site keeps serving. The SDKs fail open by default: the decision call errors or times out, and the request passes. The worst case is a gap in your classifications, never an outage on your site. If you would rather block than serve unclassified traffic, the SDKs can be configured to fail closed; see your SDK's configuration reference. The one install where that guarantee is narrower is pointing your DNS at us: decisions still fail open, but while we answer DNS for a domain, DNS itself has no equivalent.

Will you ever block traffic without me asking?

No. Your account starts analytics-only. Enforcement rules exist only after you've decided what to enforce, and they're configured with our team. No rule, no blocking. There is no default policy.

What data do you collect?

Request metadata: path, user agent, signature headers, the verification outcome, and a salted, truncated hash of the source IP in place of the raw address. To show latency and error rates, the SDK also reports your origin response's status code, content type, and size. Response bodies never reach us. On Cloudflare the worker runs in your own account, so pass-traffic flows from your zone to your origin without touching our infrastructure.

Why is this bot derived and not proven?

Because we can't prove more than we can prove. proven requires a valid signature or operator-confirmed IP ranges. derived means the user agent matches a known crawler fingerprint but the IP can't be confirmed either way. The proof ladder is deliberate about this: a tier is a claim about evidence, and inflating it would make every tier worthless.

Can't a bot just fake its user agent?

Yes, and the ladder is built for that. A faked UA with nothing else behind it classifies as derived at best. A faked UA contradicted by the real operator's published IP ranges classifies as spoofed, which is more useful than a silent block: now you know someone is impersonating Googlebot at your site.

I need to revoke a key. How fast does it take effect?

Revoke it in API keys; it stops being accepted everywhere within about two minutes. The window is cache propagation. The revoked key stays visible in the dashboard so you can confirm nothing is still presenting it.

What about retention, compliance certifications, and a status page?

None of the three is published yet. That's an early-access reality, not a secret: ask us and we'll show you where each one stands for your review.

Can I charge agents for access?

Yes. Paid routes put a price on one of your paths, and an agent pays for it with x402. It's in early access and enabled per organization, so ask us to turn it on. A new route only records what it would have charged until you start charging, and policy still runs first: a block beats a payment, so nobody buys past a rule you wrote.

Do you support ERC-8004?

We mirror the on-chain registry, and an agent registered there can prove a live request by signing it with the wallet its registration names. Being registered is not itself evidence about a request, because the standard sends nothing a receiver can check, so it never earns a tier on its own. The details.

My platform isn't Vercel or Cloudflare.

Point your DNS at us and nothing needs installing on your platform: enforcement runs in front of your site. Otherwise tell us what you're running. The platform-specific part of an SDK is small.