Does TollBit replace Akamai, DataDome, HUMAN or Imperva bot management?
No. Bot management decides who a visitor is and what to do with them: allow, challenge, block or route. TollBit is what you route AI agents to. Akamai, DataDome, HUMAN, Imperva and Cloudflare Bot Management stay in front, doing the detection they are built for. TollBit sits behind the "route" decision as the origin for identified AI agents on your own domain. Akamai, DataDome, HUMAN and Imperva are TollBit integration partners for exactly this pattern.
What bot management does well
Bot management vendors classify traffic at the edge. They separate humans from automation using signals a single site could never gather: device fingerprints, behavioural patterns, IP reputation across their whole customer base, and verification of self-declared bots against published ranges. They stop credential stuffing, scraping fleets, inventory hoarding and card testing, and they do it in milliseconds before a request reaches your origin.
For AI agents they do two things. They tell you an identified AI bot is here, and they let you write a rule about it. Most now ship a category for verified AI crawlers and assistants, with a block, allow or challenge action per category.
Where the "allow or block" choice runs out
Block, and your facts leave the AI answers your customers read. Allow, and the agent gets your full human page, 300 KB to 1.2 MB of scripts and overlays, rendered by a visitor that executes no JavaScript and reads only text. Challenge, and a legitimate retrieval bot fails silently. In the Agent Sites benchmark with KERNEL, 12 of the 21 terminal failures on default sites were bot detection, including same-page blocking that never surfaced to the agent as an error.
The decision a site owner actually wants is a fourth one: serve this agent, but serve it the version built for it. That is a routing decision, and routing needs a destination.
What TollBit is in this stack
TollBit is the destination. A tollbit.yourbrand.com origin on your own domain that returns the agent-facing version of each page: server-rendered text, the same facts as the human page, no overlays, with a bot-only sitemap and robots.txt, agent-only pages and a citation fallback. For publishers the same origin applies terms, so an AI bot can be charged per fetch through HTTP 402 instead of blocked. In H1 2026, 2.6B+ AI bots were directed to the TollBit Bot Paywall this way.
Everything arrives in server logs, which is the only place AI bots show up, so the same integration gives you reads by agent, by page and by outcome.
The integration pattern
The pattern is the same on every vendor and is usually an afternoon of IT time.
- In the bot manager or CDN, select the category of identified AI agents (verified AI crawlers and user-triggered fetchers), or match the user agents directly.
- Set the action for that category to forward to the
tollbit.yourbrand.comorigin instead of your human origin. - Leave humans, Googlebot and Bingbot on their existing path. They are never routed to the agent site.
- Forward server logs so reads and referrals are measured.
The bot manager keeps doing detection and keeps its own analytics. TollBit receives only the traffic the rule sends it. If the rule is removed, traffic returns to your human origin unchanged.
Side by side
| Bot management | TollBit | |
|---|---|---|
| Job | Identify and decide: allow, block, challenge, route | Serve identified AI agents the agent-facing site |
| Position | Edge, in front of every request | Origin for routed AI traffic only |
| Sees | All traffic, human and bot | AI agents the rule forwards |
| Outcome for AI bots | A verdict | A page built for them, with terms and measurement |
| Replaces the other | No | No |
Frequently asked questions
We already block most AI bots at the WAF. Why change? Blocking is the right call for content you never want in AI systems. For product pages, FAQs and anything your customers ask assistants about, blocking removes you from the answer. Routing lets you serve on your terms and see what was read.
Does TollBit need its own detection? It uses the vendor's classification where one exists and adds network-informed verification from 10,000+ sites, which matters because 12.7% of traffic claiming to be Claude-User was spoofed in H1 2026.
Which vendors are supported? Akamai, DataDome, HUMAN, Imperva and Fastly are integration partners. The pattern also runs on Cloudflare, CloudFront and WordPress VIP, since it only requires a forwarding rule and log export.