API abuse without a browser: scoring request evidence

Not every request has a browser. API keys get scraped, trials get farmed, and credentials get stuffed — all through requests that never load a page. Browser-based bot tools have little to go on here, and a plain rate limit cannot tell a legitimate batch job from an attack.

What request evidence you already have

Your edge sees more than a URL. A request-level score can use:

• The IP address and its network context.
• Header order and shape, which are stable per client and hard to fake without looking scripted.
• Proxy and forwarding headers that reveal whether the request came through a relay.
• Whether a cookie came back on a return request.
• Any signed agent disclosure, where automation identifies itself.

Why this is different from browser scoring

A server-only integration does not pretend a browser was present. If you omit a field, the matching checks simply do not run. That keeps the result honest: you get a read on what the request actually carries, not a fabricated behavioural history.

What you can and cannot infer

You can infer a lot about how a request was made: whether it looks scripted, whether it arrived through a proxy, whether a signed agent is present, and how it differs from your normal traffic. You cannot infer intent on its own. A high-frequency client might be a scraper or a committed customer's integration.

Combine, do not replace

Request scoring is strongest alongside the controls you already have. Keep authentication and rate limits, and add a graded assessment so your policy can distinguish a burst of legitimate automation from abuse. Allow trusted agents and known partners, flag the uncertain, and block the clear cases.

Because Volance does not proxy your traffic, this adds a scoring call — not a new hop in front of your API — and the enforcement decision stays on your server.