tookii

Letting tookii through your bot protection

For the person who manages a site’s security, CDN or firewall.

What happened

Many websites put a security service in front of their pages: Cloudflare, DataDome, Akamai, Imperva and others. It sorts visitors into people and programs and turns the programs away.

tookii tests your site with personas: each one opens a real browser and tries to do something on your site, the way a visitor would. They browse like people, but they are programs, so the security service sorts them with the programs and stops them. tookii does not try to sneak past it. Every persona's browser says who it is.

What to do

Send this page to the person who manages your site's security, CDN or firewall. They add one rule:

Allow requests whose User-Agent contains your tookii key.

Your key looks like tk_ followed by 24 letters and digits. You find it in your tookii account: in the blocked test, and under Account → Bot protection. tookii's browsers send it at the end of their User-Agent, like this:

Mozilla/5.0 (…) Chrome/… Safari/537.36 tookii/1 (+https://tookii.ai/bot-protection; key=tk_…)

Once the rule is in, tell tookii the site is allowed: press I've allowed my key on (your site) in the blocked test, or add the site under Account → Bot protection. tookii sends your key only to sites you have marked, and never to any other site.

Allowing the key lets tookii's browsers in and nothing else. It does not weaken the protection for anyone who does not hold the key.

Step by step

Cloudflare

  1. In the Cloudflare dashboard, open your domain, then Security → WAF → Custom rules, and create a rule.
  2. Condition: User Agent contains your key. In the expression editor: (http.user_agent contains "tk_…").
  3. Action: Skip. Choose what to skip: All Super Bot Fight Mode rules, and anything else that stops the visit on your setup (managed rules, rate limiting rules, Browser Integrity Check).
  4. Place the rule first, so it runs before any rule that blocks.

If your zone uses Bot Fight Mode (the free plan's version), Cloudflare cannot skip it for one visitor. Turn Bot Fight Mode off for the time you test, or move to Super Bot Fight Mode, which can be skipped.

If your zone uses Bot Management (Enterprise) with a rule that blocks on bot score, add and not http.user_agent contains "tk_…" to that rule.

DataDome

  1. In the DataDome dashboard, open Custom Rules and add a rule.
  2. Match requests whose User-Agent contains your key.
  3. Response: Allow.

DataDome's public docs do not show the exact query syntax for a User-Agent match. If the rule editor does not offer one, ask DataDome support for "an allow rule on a User-Agent substring" and give them your key.

Akamai Bot Manager

  1. Create a custom bot category (for example "tookii").
  2. Add a custom-defined bot in it, identified by a User-Agent condition that contains your key.
  3. Set the action for that category to Allow in your bot management policy.

Imperva

Imperva's docs on this are not public. The rule you need is the same: allow requests whose User-Agent contains your key. Ask Imperva support if your console does not offer it.

Anything else

The rule is the same everywhere: allow requests whose User-Agent contains your key. Most security products can do this.

If you cannot change the site

  • Test a page that sits before the security check.
  • Run the test with personas visiting as guests. When a guest visit is turned away, tookii tries a second browser on its own.

Questions

Does this weaken our protection? No. The rule lets in requests that carry your key and nothing else. Anyone without the key is checked as before.

Does tookii get past protection on sites that did not allow it? No. Without a rule, tookii's browsers are stopped like any other program, and the test says so.

Where does tookii send the key? Only to sites you marked as allowed in your tookii account. A visit to any other site carries no key.

What does the key let tookii do? Browse the site the way a visitor does, in a real browser, for the tests you run. It is not a password and opens nothing on its own.

Can we revoke it? Yes. Under Account → Bot protection, Rotate makes a new key. The old one stops being sent from your next test, so update the rule with the new key.

What does tookii send besides the key? A normal Chrome browser's requests. Once tookii is registered as a verified bot, its requests also carry a signature that identifies tookii itself (Web Bot Auth), never your account.

Questions this page does not answer: security@tookii.ai. Tell us which security product your site uses.

← Back to TookiiSecurity →