Bot Protection that Doesn't Kill UX

Duckity protects your app's APIs from automated abuse using verifiable computational work, rate limiting, and network-level signals, without ever prompting your users.

Say Bye to
Clicking Buses

Client
Rate-limiting
Network signals
Computational challenges
Your servers

Duckity combines rate limits, network signals, and VDF-backed computational challenges to make abusing your application require meaningfully more resources. All without ever prompting your users.

Stay Private
and Accessible

Pixel art of a lockPixel art of a lockPixel art of a lock
Protection from Europe

Your end users’ data is stored and processed in Frankfurt, Germany.

Invisibility = Accessibility

Duckity never prompts the user with visual nor auditory puzzles, staying accessible to everyone.

Nothing but IPs

Duckity only processes the client’s IP and their requests. IPs are many times anonymized.

Gain Control

Gain control over your application’s security with Duckity’s applications and policies.

Python
JavaScript
TypeScript
Rust
React

Integrate in
5 Minutes

Duckity comes with SDKs ready for multiple web and native frameworks and platforms.
import * as duckity from "@duckity/js";
let solution: string = await duckity.solve(POLICY_ID);

Get Protected for Free

Hobby

Free Forever
Comes with:
10,000 challenges per month
"Protected by Duckity" label
1-week analytics retention
Best effort Human Support™

Pro

$49/mo + taxes
Comes with:
100,000 challenges per month
White labeling
3-month analytics retention
Priority Human Support™
Addons:
$0.50 for 1,000 extra challenges

Frequently
Answered
Questions

All of your and your end users' data is processed in Frankfurt, Germany.
We process their IP and any requests made for challenges. Request metadata is kept for as long as you configure your policies.
Duckity analyzes, scores, and throttles traffic dynamically. With policies, it allows you to define what human activity looks like. This way, bots are required to behave like humans. Thanks to our VDF-based proof-of-work challenges that automatically adjust with activity, you get predictable performance and UX across your clients while substantially increasing the cost an abuser has to pay to harm your system. Duckity does not try to figure out who's a bot and who's not, rather enforces rules so that behaving in disallowed ways costs increasinly extra resources.
Duckity does not try to tell what a human is. Instead, it enforces speed limits and computational costs that make attacking your system increasingly costly. There's no one-size-fits-all standard for acceptable behavior, so Duckity allows you to define what acceptable behavior looks like for your application and enforces it on your behalf, so you don't have to.
Not at all! We've made it so that you don't take more than a few minutes getting it ready. It's easy.
CAPTCHAs break UX, they're usually constrained to web platforms, are usually not friendly for people with accessibility needs, not privacy-friendly¸ rely on AI that tries to "guess", yield false positives and negatives, and most of the time carry bad experiences your users have previously had with them elsewhere. Duckity is invisible, user-friendly, prompts nobody, and is way more cost-efficient than alternatives (up to x2 cheaper than reCAPTCHA and hCaptcha).
As long as your platform has a CPU, some RAM, and a network connection, yes. Duckity works in a lot of places, from web apps and native apps to headless CLIs and game engines. We provide a few SDKs for you to get started with it easily, and in case we don't have one pre-made for your platform yet, we have a step-by-step guide on how to write one for any platform. Need help with it? Open a support ticket and we'll help you out!

Got more questions? Email us.

Protect your application
against bots and AI