Introducing IsAgent: understand and support AI agents using your site

At Stytch, we’re excited to announce IsAgent, a lightweight tool that helps you identify agentic and programmatic traffic on your site and nudge them towards tailored agent experiences.

Often when we talk about bots, we think of “bad bots”: malicious scripts that are trying to exploit security vulnerabilities and commit fraud. But what about “good bots”? Increasingly, AI agents and other automation tools are used to do real work on behalf of real users.

IsAgent enables you to welcome AI agents and other good bots. Here’s a demo of what the resulting experience looks like, featuring Browserbase:

“At Browserbase, we power tens of millions of automated browser sessions every month. When AI agents self-identify as good actors, websites can provide improved UX and a true agent-native experience. We’re working with Agent Identity leaders like Stytch to make the web friendlier for agents and humans, and IsAgent closes that loop.”
— Peyton Casper, Product - Identity & Trust at Browserbase

Many companies aren’t aware of how much programmatic traffic they have (Imperva estimates 51% of all web traffic in 2025 was automated!). It’s also unclear what proportion of their traffic is made up of AI agents. That’s a risk to their future.

That’s why we built IsAgent: to help companies identify agents and plan for agent-first experiences.

Are you missing the next big platform shift?

As AI agents become more common, it’s increasingly important to know when your users are real people and when they’re bots acting on someone’s behalf.

Did your website have a mobile-optimized version 15 years ago? At that time, it wasn’t clear that mobile would become a popular platform. The most successful companies didn’t blindly throw resources at creating responsive sites and native apps; instead, they kept an eye out for mobile traffic, so that they could meet emerging needs. Mobile traffic exploded to become the majority of all traffic, and those who were prepared caught the wave.

Today, we’re at a similar inflection point with agentic traffic: AI agents like ChatGPT Agent, Anthropic’s Computer Use, and Browserbase are beginning to browse, query, and transact on the web.

We know it’s still early - most traffic is still driven by humans - but we might be on the threshold of the biggest shift since mobile. If you’re not tracking or preparing for agent behavior today, you might already be behind.

“In the old days, it was easy for a SaaS to charge $20 per month per user (seat-based pricing). But what happens when your user is an AI agent and uses your service 24/7? You need to pay attention to these changes and adapt to the situation.”
— Kshitij Grover, Co-Founder and CTO at Orb

Why target the Agent Experience (AX)?

Just as mobile users have different needs from desktop users, AI agents have different needs from human users. Netlify CEO Mathias Biilmann recently coined the term “agent experience”, or AX, to refer to the practice of supporting AI agents as a first-class citizen of your app - just like user experience (UX) or developer experience (DX).

We know that AI agents have their strengths and weaknesses. LLMs improve their visual capabilities with every release, but they’re still far better at handling plain text. Let’s nudge them towards agent-first standards like LLMs.txt and MCP servers. Instead of making end users give their passwords away, let’s support first-class experiences based on OAuth, with proper scoping and consent management.

"Freestyle is the cloud to run and manage code written by AI. As we see more of our users writing code with AI, we have spent a lot of our time thinking about how future development works, including revamping our docs for AI Coders. We're excited about IsAgent and the control it gives us in enabling unique experiences for coding agents working with Freestyle."
— Ben Swerdlow, Co-Founder and CEO at Freestyle Cloud

Up until now, it has been difficult for site owners to understand their agentic traffic. At Stytch, we’ve been doing this for months, powered by our Device Fingerprinting product. We’re excited to make it easy for everyone, using IsAgent.

How to get started

With just a few lines of code, IsAgent enables you to detect traffic from agents like Browserbase or ChatGPT Agent. It’s as easy as:

import { isAgent } from '@stytch/is-agent';

const { is_agent_client_hint, identity } = await isAgent(stytch_public_token);

/* Response: 
{
  "is_agent_client_hint": true,
  "identity": "ChatGPT Agent"
}
*/

You can then measure, understand, and respond appropriately:

• Measure agentic traffic by sending events to your existing analytics provider, like Heap, PostHog, or Datadog
• Understand how agents are using your site, and where they’re having trouble
• Respond by nudging them towards AX-friendly flows

IsAgent is designed for you to build bridges to your AI agent users. Hear how Mintlify, the AI-native docs platform, is thinking about this:

“At Mintlify, we believe documentation is going to be 50% for humans and 50% for LLMs. That’s why we’ve developed and popularized copy-to-Markdown and LLMs.txt, in order to make it easier for developers to bring the right context to their coding agents. Stytch is building for this same future with IsAgent, allowing AI agents to improve the speed and quality of their responses.”
— Hahnbee Lee, Co-founder and CTO at Mintlify

It’s free to start using IsAgent with the registration of a Stytch account. Learn more about how to install and use IsAgent on our site: IsAgent.dev .

Frequently asked questions (FAQ)

How does IsAgent work?

IsAgent uses a lightweight API call that captures characteristics like User Agent and TLS fingerprint and matches them with known AI agents. The results from IsAgent are best-effort heuristics that may be incorrect at times. We don’t expect perfect accuracy due to the wide variety of agents and bots, as well as technical limitations; for example, the techniques used will not detect many locally-hosted browser agents.

At Stytch, we are also working with Browserbase to enable optional self-identification of agents through web standards. This means that users would have the option to declare their agents’ identity in Browserbase. The agents would then send cryptographically-signed messages so that website owners can actually verify identities, unlike the easily-spoofable User Agent header.

Can I block bad bots with IsAgent?

Short answer: no, but you can with Device Fingerprinting.

IsAgent is a lightweight frontend integration to help you identify agents and bots quickly. But malicious actors can always tamper with frontend logic, so think of the results as a “client hint”, not a security guarantee. You should use IsAgent for analytics and to nudge bots towards different flows, rather than to block bots entirely.

Stytch Device Fingerprinting is a better fit for blocking bad bots. It uses similar technology under-the-hood, but has a deeper integration with a dedicated frontend script and backend Lookup API in order to detect deception and other client-side manipulation. Organizations like Calendly and Replit trust Stytch Device Fingerprinting to defend against sophisticated bots and bad actors.

Try it out

Your next users might be agents. Unsure of where to start? Welcome them in 5 lines of code using IsAgent.

To learn more about Stytch Device Fingerprinting, contact us for a free trial or live demo.

Or to help agents auth securely to your app, check out Connected Apps.

The future of the web includes agents. Are you ready?