# camada

> camada keeps bad actors out of web apps and APIs: attackers using AI, AI agents that act like attackers, credential stuffers, scrapers and CVE exploit scanners. Customers and verified search crawlers get through.

An SDK inside the app (Node, Next.js, Hono, Python, Go, PHP, Ruby, Java and .NET) sends one redacted event per request. Watchkeeper, camada's AI analyst, reviews the traffic every few minutes and writes a verdict with the evidence behind it. The SDK enforces the resulting blocklist in the app's own process, with a 403 or a challenge page. If camada is down or the SDK fails, the app keeps serving (fail open).

- Plans: Free: $0/month, 100,000 events a month; Starter: $59/month, 1,000,000 events a month; Growth: $249/month, 10,000,000 events a month; Enterprise: price set with each customer, for volume past Growth. Free needs no card. A 14-day trial of Starter or Growth needs a card. Nothing is charged today. Cancel before the trial ends (the date is shown in the app) and you pay nothing. Otherwise the plan's monthly price starts on day 15.
- Sign up and create a project at https://my.camada.app. The project key (CAMADA_KEY) is shown once, when the project is created.
- Every page below is also served as Markdown: the links point at the .md files, and each HTML URL returns the same Markdown when requested with `Accept: text/markdown`.
- Coding agents adding camada to an app: follow the quickstart for the framework, and use the install command it shows (PHP, Java and .NET install from GitHub until they are on their registries). The same steps are at https://www.camada.app/AGENTS.md, and as an agent skill listed at https://www.camada.app/.well-known/agent-skills/index.json.
- Company: Camada Labs, LLC. Contact hello@camada.app; security reports to security@camada.app.

## Product

- [Home](https://www.camada.app/index.md): Watchkeeper, camada's AI analyst, finds attackers, rogue AI agents and credential stuffers in your traffic. Your app blocks them. Customers get through.
- [Security middleware for your framework](https://www.camada.app/frameworks.md): camada SDKs for Express, Next.js, Hono, NestJS, FastAPI, Django, Flask, Go, Rails, Laravel, Spring Boot, ASP.NET Core and more. One package, one env var.
- [camada glossary](https://www.camada.app/glossary.md): The terms camada uses, in plain words: bad actor, Watchkeeper, verdict, blocklist, challenge, fail open, credential stuffing, TLS fingerprint and more.
- [How camada works: events in, analysis, blocklist out](https://www.camada.app/how-it-works.md): How camada finds bad actors: events from your SDK, scoring rules, an AI triage model and an investigation agent, then a blocklist your app enforces.
- [camada pricing, by events per month](https://www.camada.app/pricing.md): Plans priced by events: Free, Starter $59/mo, Growth $249/mo and Enterprise. 14-day trial needs a card, Free does not. Going over never blocks traffic.
- [Security and privacy: fail open, every time](https://www.camada.app/security.md): What leaves your app and what never does, how every camada SDK fails open, how long request data is kept, where it is stored and who can see it.

## Docs

- [camada docs](https://www.camada.app/docs.md): Install camada in your framework, then read the reference: webhook payloads, rules and list entries, challenges, billing, the chat agent and the API.
- [How billing works](https://www.camada.app/docs/billing.md): How camada bills: one event per request your SDK sees, the card-required trial, Free with no card, overage per million, and what changes when you downgrade.
- [Challenge](https://www.camada.app/docs/challenge.md): How a camada challenge works: a first-party proof-of-work page your SDK serves to suspect browsers, the _cch cookie, API signals and SDK support.
- [Chat with your agent](https://www.camada.app/docs/chat.md): Ask camada's agent why a client was blocked: the tools it answers from, the change cards you confirm, guided workflows, rate limits and token budgets.
- [.NET: ASP.NET Core](https://www.camada.app/docs/dotnet.md): Install camada in ASP.NET Core with AddCamada() and UseCamada(): the options it takes, what this position sees, and how it fails open.
- [Go: net/http](https://www.camada.app/docs/go.md): Install camada in a Go app with one line of net/http middleware, for any router built on http.Handler: options, what it sees, and how it fails open.
- [Hono on Cloudflare Workers](https://www.camada.app/docs/hono.md): Install @camada/hono on Cloudflare Workers in two lines. The options, what this position sees (TLS fingerprint, ASN, country) and how it fails open.
- [Java: Spring Boot, any servlet container](https://www.camada.app/docs/java.md): Install camada in Spring Boot or any servlet container with one jakarta.servlet.Filter: the options it takes, what this position sees, how it fails open.
- [Memory](https://www.camada.app/docs/memory.md): camada's per-project memory: the facts about your site you can read and edit, how they are indexed, and how the investigation agent quotes them.
- [PHP: front controllers, Laravel](https://www.camada.app/docs/php.md): Install camada in Laravel or any PHP front controller under FPM, php -S or mod_php: the options, the file-backed runtime, and how it fails open.
- [Python: FastAPI, Django, Flask](https://www.camada.app/docs/python.md): Install camada in FastAPI, Django, Flask or any ASGI or WSGI app in two lines: the options it takes, what this position sees, and how it fails open.
- [Ruby: Rails, Sinatra, any Rack app](https://www.camada.app/docs/ruby.md): Install camada in Rails through the Railtie, or in Sinatra, Hanami and any Rack app: the options it takes, what this position sees, how it fails open.
- [Rules and list entries](https://www.camada.app/docs/rules.md): What a camada rule or list entry can match: IP, CIDR, path, session, TLS fingerprint, ASN and country, and which SDK positions can enforce each one.
- [Webhook payload](https://www.camada.app/docs/webhooks.md): camada webhook reference: the alert event catalog, the JSON payload, the x-camada-signature HMAC-SHA256 scheme with a Node snippet, and the retries.

## Quickstarts

- [ASP.NET Core quickstart](https://www.camada.app/docs/quickstart/aspnet.md): Keep credential stuffers, scrapers and exploit scanners out of your ASP.NET Core app: install from GitHub, two lines and one env var.
- [Django quickstart](https://www.camada.app/docs/quickstart/django.md): Keep credential stuffers, scrapers and exploit scanners out of your Django app: pip install camada, two lines and one env var.
- [Express quickstart](https://www.camada.app/docs/quickstart/express.md): Keep credential stuffers, scrapers and exploit scanners out of your Express app: npm i @camada/node, two lines and one env var.
- [FastAPI quickstart](https://www.camada.app/docs/quickstart/fastapi.md): Keep credential stuffers, scrapers and exploit scanners out of your FastAPI app: pip install camada, two lines and one env var.
- [Fastify quickstart](https://www.camada.app/docs/quickstart/fastify.md): Keep credential stuffers, scrapers and exploit scanners out of your Fastify app: npm i @camada/node, two lines and one env var.
- [Flask quickstart](https://www.camada.app/docs/quickstart/flask.md): Keep credential stuffers, scrapers and exploit scanners out of your Flask app: pip install camada, two lines and one env var.
- [Go quickstart](https://www.camada.app/docs/quickstart/go.md): Keep credential stuffers, scrapers and exploit scanners out of your Go app: go get github.com/camada-app/camada-go, two lines and one env var.
- [Koa quickstart](https://www.camada.app/docs/quickstart/koa.md): Keep credential stuffers, scrapers and exploit scanners out of your Koa app: npm i @camada/node, two lines and one env var.
- [Laravel quickstart](https://www.camada.app/docs/quickstart/laravel.md): Keep credential stuffers, scrapers and exploit scanners out of your Laravel app: install from GitHub, two lines and one env var.
- [NestJS quickstart](https://www.camada.app/docs/quickstart/nest.md): Keep credential stuffers, scrapers and exploit scanners out of your NestJS app: npm i @camada/node, two lines and one env var.
- [Next.js quickstart](https://www.camada.app/docs/quickstart/nextjs.md): Keep credential stuffers, scrapers and exploit scanners out of your Next.js app: npm i @camada/next, three files and one env var.
- [PHP quickstart](https://www.camada.app/docs/quickstart/php.md): Keep credential stuffers, scrapers and exploit scanners out of your PHP app: install from GitHub, two lines and one env var.
- [Rails quickstart](https://www.camada.app/docs/quickstart/rails.md): Keep credential stuffers, scrapers and exploit scanners out of your Rails app: bundle add camada, two lines and one env var.
- [Spring Boot quickstart](https://www.camada.app/docs/quickstart/spring.md): Keep credential stuffers, scrapers and exploit scanners out of your Spring Boot app: install from GitHub, two lines and one env var.

## Use cases

- [Keep rogue AI agents and AI-driven attackers out](https://www.camada.app/use-cases/ai-agents.md): Attackers use AI to scan, write exploits and try passwords. camada judges each client by what it does: rogue agents get blocked, agents you trust get in.
- [Credential stuffing protection that knows which logins failed](https://www.camada.app/use-cases/credential-stuffing.md): Catch credential stuffers and password sprays from what your login code knows: failed logins per account, one-try farms, hosting networks. Block them in-app.
- [Find the clients probing your app for known CVEs](https://www.camada.app/use-cases/cve-exploits.md): camada matches your traffic against CVE exploit signatures refreshed daily from CISA KEV and open rule sets, and looks back 7 days when a new CVE appears.
- [Scraping protection that keeps search engines in](https://www.camada.app/use-cases/scraping.md): Spot scrapers by what they do across a session: page rate, no JavaScript, dropped cookies, faked crawler names. Googlebot and your allow-list still get in.

## Comparisons

- [camada vs Arcjet](https://www.camada.app/compare/arcjet.md): camada and Arcjet both run inside your app. Arcjet decides each request on rules you write; camada's AI analyst judges whole sessions. Setup, languages, price.
- [camada vs Cloudflare Bot Management](https://www.camada.app/compare/cloudflare-bot-management.md): Cloudflare Bot Management scores each request at its edge. camada runs inside your app and judges whole sessions with an AI analyst. Setup, signals, price.

## Optional

- [Contact camada](https://www.camada.app/contact.md): Email camada about plans and the Enterprise tier, report a vulnerability, or send a privacy or DPA request. Check the status page first if something is down.
- [Service status](https://www.camada.app/status.md): Live status of the camada website, app and API, and ingest: uptime over the last 24 hours and p95 check latency, read from the app's public status endpoint.
- [App API (OpenAPI 3.1)](https://my.camada.app/api/openapi.json): the HTTP API the camada app uses, with session-cookie auth; its public status endpoint is https://my.camada.app/api/status
- [Full text](https://www.camada.app/llms-full.txt): every page above in one file