An integration is the piece of code or configuration that sits in front of your website, on your CDN or server, and decides which requests come from bots. It asks Jazui for those; everything else goes to your website unchanged. You don't have to touch your application.
Which one to choose
If you have several options, the best one is usually the one closest to the user: Cloudflare, Vercel or Netlify, otherwise your framework's (Express or ASP.NET Core) rather than the web server's. The code-based ones always fall back to your website if Jazui fails and update themselves.
How they differ
| Cloudflare, Vercel, Netlify, Express | ASP.NET Core | nginx | IIS and Apache | |
|---|---|---|---|---|
| Bot list | Downloaded daily on its own | Downloaded daily on its own | In the configuration | In the configuration |
| Reports unknown bots | Yes | Yes | No | No |
| If Jazui fails | Serves your website | Serves your website | Serves your website (except a 403) | The bot gets the error |
| Maximum wait | 20 s | 20 s (configurable) | 20 s | The server proxy's |
| Sends to Jazui | Only what's needed | Only what's needed | The bot's headers, without cookies | The bot's headers, without cookies |
What they all do
- They decide whether the request is from a bot:
GETorHEAD, user agent in the bot list (or_escaped_fragment_in the address), a path that isn't a file and noX-Jazuiheader. - They ask Jazui for it:
GET https://api.jazui.com/Renderwith the full address, the user agent, your token inAuthorization: Bearer, the bot's IP inX-Jazui-Client-IPand the bot'sIf-None-Match. - They pass Jazui's response to the bot if it has
X-Jazui: true(200, 404, redirects, 304…), with itsContent-Type,ETag,Last-ModifiedandX-Jazui-Cache; or the403withX-Jazui-Blockedif you blocked the bot. - In any other case they serve your website: Jazui is slow, fails, the token is invalid or the plan is used up.
The details are in How it works.
The bot list
Jazui maintains a list of more than 230 bots (search engines, AI, social networks and SEO tools) and publishes it without a token:
curl https://api.jazui.com/v2/bots
curl https://api.jazui.com/v2/bots.txt/v2/bots returns JSON with the version, date and fragments; /v2/bots.txt, one fragment per line. The code-based integrations download it at startup and every 24 hours; if they can't, they keep the list they ship with. For nginx, IIS and Apache you copy it by hand when it changes: each page explains how.
What never goes through Jazui
Paths ending in these extensions are always served by your website, whoever asks:
js mjs css less map json xml rss txt webmanifest ico png jpg jpeg gif webp avif svg bmp tif tiff psd ai woff woff2 ttf otf eot mp3 m4a wav ogg mp4 m4v webm avi mov mpg mpeg wmv flv swf pdf doc docx xls xlsx ppt pptx csv zip gz rar 7z iso torrent exe dmg apk wasm dll dat blat
POST, PUT… requests don't go through either, nor do requests carrying the X-Jazui header (Jazui's own while rendering).
Which token to use
Any integration works with the account token (Home › Integration and settings) or the site token (Websites › Site token). If you have several sites, use each site's own token: if one leaks, you change it without touching the others. Never use the PUBLIC Token in an integration.
Checking any integration
With curl and the test user agent integration-test, which every integration treats as a bot:
# Como un bot: debe llevar x-jazui: true
curl -I -A "integration-test" https://misitio.com/
# Como una persona: tu web de siempre, sin x-jazui
curl -I https://misitio.com/
# Un archivo estático nunca pasa por Jazui
curl -I -A "integration-test" https://misitio.com/favicon.icoYou can also use Google Search Console's URL Inspection tool or the Facebook or LinkedIn preview debuggers to see the page as they get it.