Arcjet helps developers protect their apps in just a few lines of code. Bot detection. Rate limiting. Email validation. Attack protection. Data redaction. A developer-first approach to security.

This example shows how to test that your Express.js routes protected by Arcjet behave as expected. It uses Newman to run Postman collections against a running server, driven by the Node.js built-in test runner.

• Rate limiting protects two routes with different fixed-window limits so you can assert both the allowed and rate-limited responses.
• Bot protection protects a route that blocks all bots, asserted with a bot-like User-Agent.
• Automated tests with node --test and Newman verify the Arcjet decisions for each route using the Postman collections in tests/.

Each route applies its Arcjet rule inline with .withRule() so the sample stays self-contained. In a real app you should define static rules once, outside the request handler, for better performance.

1. Register for a free Arcjet account.

2. Install dependencies:

   npm ci

3. Rename .env.local.example to .env.local and add your Arcjet key.

4. Start the server:

   npm start

5. In another terminal, run the included Postman collections as tests:

   npx newman run tests/low-rate-limit.json
   npx newman run tests/high-rate-limit.json -n 51
   npx newman run tests/bots.json

6. You can also stop your server and run the collections as part of your test suite. The suite starts and stops the server for you:

   npm test

Check out the docs, contact support, or join our Discord server.

All development for Arcjet examples is done in the arcjet/examples repository.

You are welcome to open an issue here or in arcjet/examples directly. However, please direct all pull requests to arcjet/examples. Take a look at our contributing guide for more information.