Good Bot, Bad Bot: Securing Your APIs in the Era of Agentic AI

The internet is changing fast. If you look at Cloudflare’s recent vision for web traffic, they predict AI bots and autonomous agents will actually outnumber human users by 2027. We are moving away from an internet built for humans browsing web pages to an "Agentic Web" where AI agents do the heavy lifting. They book flights, scrape training data, and interact with APIs in the background.Because of this shift, the old rule of simply blocking all bots no longer works. As outlined in Cloudflare's resource on how to manage good bots, the future of bot management is all about sorting the good from the bad. You need to allow helpful AI agents to do their jobs while keeping malicious scrapers out. But as companies dump money into Web Application Firewalls (WAFs) to manage this new reality, they are ignoring a massive blind spot: mobile APIs.

The Mobile Pivot and the Back Door

When a company buys a high-end WAF to lock down its web endpoints, attackers do not just pack up and go home. They pivot. They tear apart the company's mobile app, find the API endpoints, steal the API keys, and disguise their bot traffic to look exactly like a real user on a phone.

This works because traditional web bot management is completely out of its element in mobile environments. Web defenses rely heavily on client-side telemetry. Think JavaScript challenges, mouse tracking, and browser fingerprinting. Those checks are great in a browser, but native mobile apps do not run JavaScript challenges. They do not have trackable mouse movements. When security tools try to apply web rules to mobile API traffic, they end up guessing.

Attackers know this. They use customized Android emulators, repackaged apps, and hooking frameworks to fake that client-side data. A malicious script ends up looking identical to a legitimate iPhone user. If you spend heavily on a WAF but leave your mobile APIs open to this kind of spoofing, attackers will just bypass your expensive security through the back door.

Beyond Web Filters: Rethinking Good vs. Bad Bots on Mobile

While web-based bot managers classify browser traffic using probabilistic behavior and IP reputation, mobile environments demand a completely different model. Approov solves the mobile "good bot vs. bad bot" dilemma by shifting from probabilistic guessing to deterministic cryptographic proof.

In mobile API defense, a "bad bot" isn't just an automated web scraper—it is often a cloned, modified, or instrumented version of your own mobile app running inside emulators or hook-enabled environments. Conversely, a "good bot" or legitimate client in the mobile realm must demonstrate that it is running an untampered, official mobile binary on a secure, non-compromised device.

Instead of relying on browser signatures or JavaScript challenges (which mobile APIs cannot execute), Approov provides a runtime attestation engine:

• Cryptographic Proof of Authenticity: Approov verifies two fundamental conditions before trusting an API request: Is the request coming from an authentic, unmodified mobile app? Is the host device safe (unrooted, untampered, and non-emulated)?
• Zero Secrets & Short-Lived Tokens: Upon successful attestation, Approov issues a short-lived, cryptographically signed token. Bad bots cannot extract static keys from the app binary because no permanent secrets are stored in the client.
• Zero False Positives: Real mobile app users seamlessly receive valid attestation tokens and pass through without friction, CAPTCHAs, or false-positive blocks. Unauthorized scripts and tampered apps fail attestation instantly and are dropped at the edge.

Stop Guessing, Start Proving

To protect server-side decisions from mobile API abuse, we need to stop guessing and start proving. This is exactly what Approov does.

Instead of relying on client-side behavioral data that attackers can easily fake, Approov uses deterministic cryptographic proof. It acts as a runtime attestation engine. Before an API request gets any trust, Approov answers two basic questions. First, is this request actually coming from our real, unmodified mobile app? Second, is the device safe? Meaning it isn't an emulator, it isn't rooted, and it hasn't been tampered with.

If the answer to both is yes, Approov hands over a short-lived, cryptographically signed token. When integrated, an edge compute worker, reverse proxy, or API gateway intercepts the API request at the edge. Beyond basic token signature verification, it validates expiration, required claims, and any configured user or request data bindings. For even stronger defense, Approov can enforce request message signing using a device-generated public key, ensuring payloads cannot be tampered with in transit. Without a valid token and intact signature, bad traffic is dropped instantly before reaching your backend. It knows with total certainty that the request is legitimate. There are no CAPTCHAs, no guesswork, and no false positives.

Layering Approov with Your WAF

WAFs and edge security platforms like Cloudflare are incredible at handling massive traffic spikes, managing DDoS attacks, and categorizing web-based AI agents. But to make the right calls on mobile endpoints, they need verified data.

Pairing Approov with your WAF creates a solid layered defense. The WAF handles the web traffic and categorizes the AI agents hitting your public site. Meanwhile, Approov locks down the mobile API side by passing its token as a standard HTTP header.

When integrated, an edge compute worker or reverse proxy intercepts the API request at the edge. It checks the Approov token signature and drops any bad traffic before it even gets close to your backend servers. If bad bots strike out on the web and try to hit your mobile APIs instead, they hit a wall. Without a valid token, the WAF drops them instantly.

Prepping for What is Next

The line between a bot and a real user is going to keep blurring. Cloudflare is already building the infrastructure to authenticate AI agents because autonomous machines will drive the future of internet commerce.

To survive in a world dominated by automated traffic, you need a Zero Trust approach for your APIs. A valid API key is no longer enough proof of identity because keys get stolen every day. You have to verify the actual client environment making the request.

By mixing the probabilistic intelligence of a modern WAF with the hard cryptographic proof of Approov, you can safely welcome helpful AI agents while permanently shutting out the bots targeting your mobile infrastructure.