Vercel BotID is an invisible bot check for apps hosted on Vercel. A client-side challenge rides on the requests you choose, and your server calls checkBotId() to get a verdict, with no widget and no puzzle for the visitor. Use it on the few high-value routes a bot would target, on a Vercel deployment; use Turnstile or reCAPTCHA when you host elsewhere. We use BotID on the public writes of the shared clip page in Monogram Tools, our own multi-tenant workspace.

What is Vercel BotID?

BotID is Vercel's answer to the CAPTCHA that nobody wants to solve. Vercel describes it as an invisible CAPTCHA that never shows the visitor a challenge or asks them to do anything. The browser receives a challenge, solves it in the background, and attaches the solution to the requests you have marked as protected. Your route handler calls checkBotId(), Vercel validates the response, and your code decides what to do with the result.

It is built for routes where a bot imitating a person costs you something, such as sign-ups, checkouts, comment forms and endpoints that trigger email or model calls.

How does BotID compare with Cloudflare Turnstile and reCAPTCHA?

The deciding question is where your app runs. BotID works only on Vercel deployments, and in exchange it needs no token plumbing: there is no token to forward and no separate verification endpoint to call. Turnstile works on any host, issues a token your server sends to Siteverify with a secret key, and its managed mode can show a checkbox when it sees elevated risk. reCAPTCHA v3 returns a score for each request without a visible challenge and is not tied to a host either.

We run both kinds. The contact form inside the monogram.io site assistant fetches a reCAPTCHA v3 token on each submission. BotID guards the public share page in Monogram Tools.

This is the rough guidance we give clients.

On Vercel, protecting a few named routes: BotID. Basic mode costs nothing, and the integration is two small pieces of code, one on the client and one on the server.
Hosting outside Vercel, or a plain HTML form: Turnstile or reCAPTCHA, since BotID is not available there.
Bots that run a real browser and behave like people: BotID Deep Analysis, or the enterprise tier of whichever vendor you already use.

Basic or Deep Analysis: which do you need?

Basic validates that the challenge response is intact and correct, which catches the less sophisticated bots, and it is free on every plan. Deep Analysis runs only after Basic passes and uses a Kasada-powered model over client-side signals to catch automation that drives a real browser, such as Playwright or Puppeteer scripts. On Pro, Vercel bills Deep Analysis per checkBotId() call, at $1 per 1,000 calls at the time of writing; requests that never call checkBotId() are not billed.

Start with Basic where a stray bot costs little and other controls already sit on the route. If a route triggers paid work, such as a model call, an email send or an account creation, Deep Analysis is the level to price out.

Where does BotID go in a Next.js app?

There are two pieces. On Next.js 15.3 and later, the client calls initBotId from instrumentation-client.ts with the exact list of paths and methods to protect. Each protected route calls checkBotId() on the server and refuses a bot. Vercel's current docs say the withBotId config wrapper is no longer needed, because Vercel now routes the challenge requests itself; the client and server halves are all a new app needs.

The list is the part worth thinking about. Most of Monogram Tools sits behind a sign-in, so most writes come from a known person. We run BotID on the public writes of the shared clip page. A shared clip is watched by whoever its creator sent the link to, and that viewer has no account by construction, so a write from that page carries no sign-in to vouch for it.

How does BotID behave in local development and tests?

In development mode, checkBotId() returns { isBot: false } for every request, and the developmentOptions.bypass option lets you simulate a bad bot to test your refusal path. That covers next dev. It does not cover a production build run locally.

We found that checkBotId() treats only a non-production NODE_ENV as development. Our end-to-end suite runs a production build with next start, so the check would have called Vercel's API from a machine with no Vercel credentials and thrown. If your CI runs a production build, check this before you ship.

Does BotID block good bots and AI agents?

BotID tells you when a bot is verified, and your route decides. Since botid 1.5.0, checkBotId() returns isVerifiedBot, verifiedBotName and verifiedBotCategory, drawn from Vercel's verified bot directory, so a route can let a named agent through while refusing the rest. Choose per route which verified bots you want to serve.

Where BotID stops

It is Vercel-only. A deployment that leaves Vercel takes its bot check with it, so a portable app is better served by Turnstile or reCAPTCHA.
It is one layer. BotID answers "is this a person's browser". It does not replace caps, origin checks or authorization, so it belongs alongside them.
Development mode always says human. Testing your refusal path means using developmentOptions or testing on a preview deployment.

FAQ

Is Vercel BotID free?

Basic mode is free on all plans. Deep Analysis is billed per checkBotId() call on Pro, and Enterprise pricing is custom.

Does BotID show a challenge to visitors?

No. It never renders a visible element; the challenge runs in the background.

Can I use BotID outside Vercel?

No. It requires a Vercel deployment. Turnstile and reCAPTCHA run on any host.

Should I put BotID on every route?

No. Put it on the routes where a bot costs you something, and on writes from people who are not signed in.

What does Monogram use BotID for?

The public writes on a shared clip's page in Monogram Tools, where viewers have no account.

We build on Next.js and Vercel for clients and for ourselves; see our Next.js and Vercel development work and the Vercel technology page.

Vendor references: BotID overview, Get started, local development behavior, verified bots, BotID vs Turnstile.