Clay ×
Reference Architecture
Bot Management · WAF · Logpush POC
Prepared by Rohitha Madduluri (SE) · AE Kent Starling
Diagram 1

Current State vs. Future State

Consolidating from CloudFront + AWS WAF to Cloudflare as the single edge in front of Clay's AWS origins (app / api / staging.clay.com).

CURRENT STATE FUTURE STATE — with Cloudflare Single edge, full bot/WAF enforcement + observability Clients / Bots browsers, API, agents CloudFront CDN edge AWS WAF under-utilized Netlify app.clay.com (SPA) AWS us-east-1 api / staging origin Gaps today • No bot scoring / JA3-JA4 fingerprinting • No ASN-based edge block (see /run-enrichment) • Fragmented edge; limited unified visibility Clients / Bots browsers, API, agents Cloudflare — single global edge Bot Management score + JA3/JA4 WAF + Rules ASN / IP Lists CDN / Cache replaces CloudFront Transform Rules headers to origin AWS us-east-1 api / staging origin Datadog Logpush + metrics headers logs ✓ AWS WAF displaced · unified edge · full visibility in Datadog
Cloudflare AWS / CloudFront (removed) Clay infra / origin traffic + headers to origin logs / telemetry (Logpush)
Diagram 2

Full Target Architecture

Every request to app / api / staging.clay.com passes once through Cloudflare's edge — inspected, scored, and enforced in a single pass — then enriched to origin and streamed to Datadog.

SOURCES CLOUDFLARE — SINGLE-PASS EDGE CLAY ORIGINS Users & API clients browsers · REST AI agents MCP · CLI Malicious bots single-ASN abuse one pass · one dashboard · applied close to the user DDoS Protection L3 / L4 / L7 · always-on absorbs floods WAF + Managed IP Lists OWASP · anon / VPN / proxy / botnet stops exploits Bot Management bot score · api_score · JA3 / JA4 scores every request Custom Rule — ASN + JA3 blocks the /run-enrichment abuse pattern AWS WAF couldn't Transform Rules enriches signals as headers to origin app-level context CDN / Cache replaces CloudFront · one edge faster + consolidated Existing: Workers + KV Existing: Turnstile app.clay.com SPA api.clay.com AWS us-east-1 staging.clay.com POC starts here enriched headers → OBSERVABILITY Datadog Logpush + native metrics tile R2 / S3 → ClickHouse later phase · per-tenant analytics Logpush →
Cloudflare edge (single pass) Existing CF footprint Clay origins Observability abuse traffic clean traffic + headers
Why this wins: every request is inspected once at Cloudflare's edge across all controls, then passed to origin — no stacked point products. The ASN + JA3 rule stops the exact /v3/actions/run-enrichment abuse (multiple accounts, one ASN) that AWS WAF could not, and all of it lands in Datadog for full visibility Clay doesn't have today.
Signals Key

What Clay gets in headers & logs

Ian's requested fields, mapped to exactly where they surface. Delivered via the Transform Rules and Logpush stages above.

Signal As header to origin In logs
Bot scorecf-bot-scoreBotScore, BotScoreSrc
Action + reasoning—SecurityAction(s), SecurityRuleIDs, SecurityRuleDescription, SecuritySources
ASNip.src.asnum (custom rule)ClientASN, ClientASNDescription
GeoIPcf-ipcountry, cf-region, cf-ipcity, cf-iplatitude/longitudeClientCountry, ClientRegionCode, ClientCity, ClientLatitude/Longitude
Anon vs non-anon IPManaged IP Lists (cf.anonymizer)firewall event fields
JA3cf-ja3-hashJA3Hash
JA4cf-ja4JA4, JA4Signals
Verified botcf-verified-botbot detection fields
Diagram 3

Bot Management Flow

How a request to Clay is detected, scored, and acted on.

Clay Browser, Mobile, API 1 Request 2 Detection Machine learning JavaScript Detections Anomaly Detection Heuristics Verified bots AI bots Bot distribution score 1 99 Automated Likely automated Likely human Human Bot Score 3 Policy + Response Standard responses: Block, Allow, Log, Rate Limit, NoCAPTCHA Challenge Custom response policies via WAF, DDoS, Workers Verifying.... CLOUDFLARE Privacy • Terms Success! Blocked Clay App / API Servers 4 Analytics via Cloudflare Dashboard UI or via API in 3rd party SIEM, Analytics platform