Key differences: Vercel BotID vs Arcjet
Vercel BotID vs Arcjet is a bot-detection comparison. Teams looking for a Vercel BotID alternative usually want allow/deny by bot category, inspectable decisions, and bot detection for Next.js that is not tied to Vercel hosting.
BotID issues a token in the browser and verifies it server-side on a protected Vercel route. Arcjet bot detection runs in your request handlers: classify known bots by name and category, layer advanced client signals (headless and browser-environment anomalies, a continue cookie that persists the client signal) with IP reputation and filters, and log or act on a structured reason. Operational HTTP rules for bots, Shield, filters, and fixed-window or sliding-window rate limits change in the Arcjet dashboard or via MCP and take effect immediately, still inside the application. Token-bucket and email rules stay in code.
Allow or deny by category
Arcjet rules can vary by request context: allow a search-engine bot on a content route, deny it on a signup, change a rate limit by plan. The decision includes a structured reason you can log or act on. BotID provides few configuration options and does not let you choose which named bots to allow.
Advanced client signals vs Deep Analysis
Arcjet advanced signals run a WebAssembly module in the browser, persist a continue cookie, and evaluate with server-side bot classification and an optional missing-cookie filter. Each rule can run live or in dry-run. Vercel BotID Deep Analysis (powered by Kasada) is a similar in-browser check. It is Pro at $1 per 1,000 checkBotId() Deep Analysis calls; Enterprise pricing is custom. It issues a per-request token, not a persistent signal you can enforce as a filter, and the result is essentially boolean.
Forms and integration
You call bot detection from any request handler, including native HTML form POST. BotID is a client script plus a server check. Protected paths are listed separately from the handler. Native HTML form POST is not supported; forms have to be refactored.
Hosting
Arcjet runs on any host for JavaScript, TypeScript, and Python, including bot detection for Next.js on Vercel, elsewhere, or locally with the same behavior as production. BotID only works for JS/TS applications hosted on Vercel. Locally it returns not-a-bot; development options can bypass or override.
Vercel’s WAF and rate limiting are separate products and are configured independently. Arcjet runs bots, rate limiting, Shield WAF, email validation, filters, and IP reputation in the same request-handler call.
Comparison
| Area | Arcjet | Vercel BotID |
|---|---|---|
| What it is | Bot detection in request handlers: known bots by name and category, optional advanced client signals, filters, and IP reputation. Inspectable decision. | Browser token plus server verification on a protected Vercel route. Essentially a boolean plus limited verified-bot fields. |
| Hosting | Any host, including Next.js on or off Vercel. | Vercel only. |
| Local development | Same behavior as production. | Returns not-a-bot locally; development options can bypass or override. |
| Integration model | Call from code in any handler. | Client script + server check; protected paths are listed separately. |
| HTML forms | Works with native forms and any HTTP request. | Native HTML form POST is not supported. |
| Configuration | Allow or deny bots by name and category. Filter rules compose cookie, header, IP, and geo conditions. Operational bot, Shield, filter, and fixed-window or sliding-window rate-limit rules change in the Arcjet dashboard or via MCP immediately. Token-bucket and email rules stay in code. | Minimal config. No allow/deny list for named bots. Server API is essentially a boolean. No filter rule language. |
| Advanced bot signals | Browser WebAssembly signals, continue cookie, live or dry-run, inspectable reason. Usage maps to bot-detection calls, not script loads. | Deep Analysis (Pro $1 per 1,000 server checks; Enterprise custom): per-request token, boolean result, no persistent filter signal. |
| Layered with | Rate limiting, Shield WAF, email, filters, and IP reputation in the same request-handler call. | WAF and rate limiting are separate Vercel Firewall products. |
| Pricing (bot feature) | See the pricing page. Signals script loads are not billed. | Basic analysis: free on all plans. Deep Analysis: Pro $1 per 1,000 server checks; Enterprise custom. |
Layered bot detection
BotID answers whether an inbound HTTP client looks automated. That is the same job as Arcjet bot detection in request handlers: stop scrapers, credential stuffing, and other clients that hit /login or a signup.
Arcjet layers that decision. A request can be denied because signals look automated, because the user agent matches a known scraper, or because the IP has a poor reputation. A missing continue cookie is itself a signal you can filter on. Live or dry-run applies per rule. HTTP request checks can fail open when the Cloud API is unreachable. That is configurable.
Bot detection is an HTTP control in request handlers.
When to choose which
Choose Arcjet if
You want a Vercel BotID alternative that is not tied to Vercel; you need native form support; you want allow/deny by bot category with inspectable decisions; you need to test locally with production behavior; you want advanced client signals without a per-check Deep Analysis bill; or you want filter rules and IP reputation in the same bot decision.
Choose BotID if
You are fully on Vercel, want a quick boolean bot check, do not need to choose which bots to allow, and are fine configuring rate limits and WAF separately in the Vercel Firewall.
Compare: Vercel WAF vs Arcjet · CAPTCHAs vs Arcjet · All comparisons
Frequently asked questions
Does BotID work without Vercel?
No. Vercel BotID requires hosting on Vercel. Arcjet runs on any host, including Next.js on or off Vercel, and in local development.
How does Arcjet layer bot detection compared with BotID?
BotID verifies a browser-issued token on a protected Vercel route and returns an essentially boolean result. Arcjet classifies known bots by name and category in your request handlers, layers advanced client signals (headless and browser-environment anomalies, a continue cookie) with IP reputation and filters, and returns an inspectable reason. HTTP request checks can fail open when the Cloud API is unreachable. That is configurable. Bot detection stays on HTTP.
Can I configure which bots to allow or block?
With Arcjet you can allow or deny bots by name and category in your request handlers. For example, allow search-engine crawlers and block the rest. Vercel BotID does not provide configuration to choose which bots to allow or deny; you get limited details about which bots were detected afterwards.
Does BotID work with native HTML forms?
Vercel documents that native HTML form POST is not supported; forms have to be refactored. Arcjet bot detection is called from code in any request handler, including native form POST.
Bot detection in your request handlers
Protect your application with Arcjet
Get allow/deny by bot category, inspectable decisions, and advanced client signals, on Vercel or any other host.