Kasada
Bot management
Also known as: KPSDK, Kasada Bot Defense
Distinctive for using 429 as a challenge rather than as a rate limit, and for x-kpsdk headers that make attribution unambiguous.
Kasada inverts the usual convention. Where nearly every other product treats 429 as a rate limit and 403 as a refusal, Kasada commonly answers an unverified client with 429 as part of its challenge flow. A browser sees this only in developer tools: the 429 arrives, the client-side SDK solves a proof-of-work challenge, and the retried request succeeds. To a script, the same exchange looks like aggressive rate limiting that no amount of backing off will fix.
That single fact accounts for most of the confusion around Kasada. Backing off is the correct response to a 429 almost everywhere else, and it is the wrong response here, because the gate is cryptographic rather than temporal.
The x-kpsdk family of headers makes Kasada trivial to identify once you know to look. Kasada's own documentation is behind a customer portal, so the entries below describe observable wire behaviour.
How to identify it
- Any x-kpsdk-* request or response header, most commonly x-kpsdk-ct, x-kpsdk-cd, x-kpsdk-v, and x-kpsdk-dv. This is conclusive.
- A 429 on a first request, with no prior volume to justify a rate limit.
- A very small response body on a refusal, with no branded block page.
- A heavily obfuscated JavaScript payload served before the real content.
Headers
- x-kpsdk-ct: The continuation token carried on subsequent requests in a verified session.
- x-kpsdk-cd: Carries the result of the client-side challenge, which the gateway validates before admitting traffic.
- x-kpsdk-v: SDK version identifier.
Status codes
429 Challenge required
Challenge. Observed behaviour.
Not a rate limit. The client has no valid Kasada token and is being asked to run the proof-of-work challenge before proceeding.
What triggers it
- A first request from a client with no x-kpsdk-ct token.
- An expired or invalid token on a session that previously worked.
- Missing or malformed x-kpsdk headers on a request that supplied them.
How to confirm it
- x-kpsdk headers on the request or response.
- A 429 arriving on the very first request, which no genuine rate limit would produce.
- A minimal body with no explanatory content.
What to do about it
- Stop backing off. This is the key insight for Kasada: waiting achieves nothing because time is not what the gate is measuring. A client that retries the same tokenless request in an hour gets the same 429.
- Recognise that the site expects a full browser runtime to execute its challenge. If your client cannot run that, the endpoint is not reachable in the way you are trying to reach it, and no amount of pacing changes that.
- For legitimate access, this is a conversation to have with the site operator rather than a technical problem to grind against.
HTTP/2 429 x-kpsdk-ct: 0Abc123... content-type: text/html content-length: 0
403 Hard block
Blocked. Observed behaviour.
The request was refused outright, typically before any challenge was offered.
What triggers it
- A TLS or HTTP/2 fingerprint that failed the first-layer check, so no challenge is worth offering.
- Address reputation.
- Repeated failed or forged challenge responses.
How to confirm it
- A terse body, and x-kpsdk headers where present.
What to do about it
- A 403 rather than a 429 means the door closed before the challenge stage. Whatever the client presented was rejected at the transport or reputation layer.
- This is a harder state to leave than the 429, because there is no offered path forward.
If you run a site behind it
- Using 429 for challenges is effective against naive clients precisely because it triggers the wrong reflex, but it also confuses your own integrators and any monitoring that treats 429 as a capacity signal. Document it for your API consumers.
- Proof-of-work imposes real cost on the client, which is the mechanism. Keep an eye on the effect on low-powered legitimate devices.
If your traffic is being caught by it
- 429 plus x-kpsdk means challenge, not rate limit. This is the most valuable single line in this entry.
- A 429 on request number one is never a genuine rate limit anywhere. Treat that shape as a vendor signature.