FAQ

Is Kyli unbeatable?

No — and you should be suspicious of any bot-detection product that claims it is. If an attacker is willing to use a real browser, slowly and carefully, like a real person would, they produce real human-like behavior. That's genuinely hard to catch, for any product.

What Kyli does is make automation much more expensive to get away with. A stolen device fingerprint isn't enough on its own anymore, and neither is a fast, unattended script. In our own internal testing, Kyli caught a strong majority of even the more advanced, human-like bot scripts, with very few real users mistakenly flagged (see ML fusion). Not 100% — results depend on how sophisticated the attacker is — and we'd rather tell you that upfront than oversell it.

Does a stable, consistent device fingerprint help my score?

No. Kyli doesn't treat a stable, familiar-looking device fingerprint as proof that a session is legitimate — see Why Kyli for why. A fingerprint is mainly used to recognize a device that's already been flagged as a bad actor before. Just having a consistent fingerprint never makes a session look more trustworthy.

What happens if a legitimate user has no mouse data (touchscreen, accessibility tooling)?

Nothing bad happens. If a real user is missing some data — no mouse movement because they're on a touchscreen, for example — Kyli doesn't treat that missing data as suspicious. Rules that rely on optional data only apply when that data actually exists. See "the Golden Rule".

Can Kyli stop a fleet of coordinated bots (e.g. ticket-scalping rings)?

Not yet, as a dedicated feature. Spotting a group of bots working together — many "unrelated" sessions all grabbing tickets and retrying in sync, for example — is a different problem than spotting one bot on its own, and building it properly needs real traffic from an actual high-demand event to test against. It's on the roadmap once we have a customer situation that calls for it.

Can an attacker farm ack tokens?

Not by reusing a captured one — each ack token can only be used once, and you only get one after a session has shown a real, clean pattern of activity for a while (see Ack tokens). What we can't stop: someone running many separate, real (and therefore slower) browser sessions in parallel, each one earning its own token honestly. That still costs the attacker real time and resources — it's not a shortcut, but it's a real limit worth knowing about.

Does Kyli support SSO, 2FA, or team accounts?

Not yet — right now the dashboard only supports one email-and-password login per account. This matters once a team has more than one person using it, and we'll build it once that's actually needed rather than guessing ahead of time.

Is webhook delivery a durable queue?

Not currently — a webhook is retried up to 4 times if your endpoint doesn't respond, but it isn't backed by a separate durable queue system. Worth knowing if your endpoint is occasionally slow, though most integrations won't notice in practice. See Webhooks.

How much real customer data trains the models?

Real production data is genuinely the rarest and most valuable input we have, and there isn't a lot of it yet. To make up for that, models are also trained on a dedicated honeypot (real human testers plus a 17-script bot suite covering many real automation techniques) and outside datasets of human and bot behavior. See ML fusion. Where your agreement with us and your privacy settings allow it, anonymized feedback from your production traffic may help improve future models.

Why does a new account need manual approval right now?

This is temporary. Kyli is still being tuned to hit a detection benchmark, so every new signup is reviewed by hand before their key goes live, and approved accounts get a time-limited trial. Once that benchmark is reached, signing up will become instant and self-serve.