Bot protection

To protect your sign-ups from bots, Clerk leverages data from our CDN to determine whether a user attempting to sign up might be a bot or not.

Enable bot sign-up protection

1. In the Clerk Dashboard, navigate to the Rules⁠ page under Protect.
2. In the Bot sign-up protection row, check the Status.
   • If Disabled, select Enable. In the dialog, toggle on Enable, then select Save.
   • If Enabled, bot sign-up protection is already active and no action is required. To disable it, select Manage, toggle off Enable, then select Save.

Limitations

Native API and CAPTCHA

The Native API⁠ setting allows native applications and browser extensions to make requests to Clerk in environments that cannot always complete a browser-based CAPTCHA challenge. It enables a public request pathway through which CAPTCHA challenges are bypassed, even when Bot sign-up protection is enabled. Clerk's standard browser-based authentication flows continue to use CAPTCHA when a challenge is required.

Only enable the Native API when your native application or browser extension requires it. Because the pathway is public, it must not be treated as a secret or used as the only boundary protecting your application from automated traffic. Registering an application's bundle identifier or package name allows Clerk to validate callbacks for supported native authentication flows, but does not make the Native API pathway private.

Custom sign-up flows

If you're building a custom sign-up flow using the Clerk API instead of using Clerk components, and you have enabled Bot sign-up protection, then you need to ensure you have added a DOM node to render the CAPTCHA widget. Refer to the Add bot protection to your custom sign-up flow guide for more information.