Bot detection for your Railway apps.

Set up WebDecoy on Railway

1. Start from a template or your app

   Deploy one of five WebDecoy starters from Railway’s template marketplace (Express, Next.js, Fastify, Hono, Angular SSR), or install the WebDecoy package for your framework in an existing app.

2. Read the client IP Railway’s way

   Pass trustProxy: 'railway' to the middleware. Railway’s proxy rewrites X-Forwarded-For to the visitor followed by its own edge, so the common one-hop setting records Railway’s edge for every visitor. The starters already set it.

3. Add your API key

   Create an API key in WebDecoy and set WEBDECOY_API_KEY in the Railway service’s Variables. Keep it out of your repository.

4. Verify, then decide on enforcement

   Request any page with the user agent WebDecoy-Test/1.0 and confirm the labeled test detection. The middleware starts in Monitor; switch it to Enforce when you trust what it flags.

Read the full Railway setup guide →

See the requests a browser tag misses

AI crawlers and HTTP tools fetch pages without running JavaScript. Middleware sees every request that reaches your app, reports the automated ones, and plants a hidden link that only bots follow.

In Monitor it records what it would block and serves every request. In Enforce it answers blocked requests with a 403 inside your app. There is no edge validator on Railway; the policy runs in your code.

• Railway install guide →

Five starters, one click each

Each starter is a small public repository with the middleware, the Railway client-IP setting and a health check already in place. Use one as a starting point or copy the few lines into your app.

• Express starter →
• Next.js starter →
• Fastify starter →
• Hono starter →
• Angular SSR starter →

Questions about Railway