Railway
Railway runs your app as a container behind its own proxy. WebDecoy runs inside the app, as the Express middleware, so it sees every request that reaches your code, including crawlers that never run JavaScript.
Start from the template
Section titled “Start from the template”The Express + WebDecoy Bot Detection template deploys a small Express app with the middleware already configured. Use it as a starting point, or read its server.js and copy the few lines into your own app.
- In WebDecoy, create an API key under Settings > API Keys.
- Deploy the template. Railway asks for one variable,
WEBDECOY_API_KEY: paste the key there. It is a secret, so keep it in Railway’s variables and never in a file you commit. - Open the service’s public domain and send a test request (see Prove it reports).
The middleware starts in monitor mode: detections are recorded and every request is still served.
Add it to an app already on Railway
Section titled “Add it to an app already on Railway”Follow the Express, Fastify or Next.js install, set WEBDECOY_API_KEY in the service’s Variables, and pass it to the middleware as apiKey. The SDK does not read the variable by itself.
The client IP on Railway
Section titled “The client IP on Railway”Railway’s proxy replaces any X-Forwarded-For the client sent with exactly two addresses: the client, then Railway’s edge. The connection your app accepts comes from a third, internal address. So the visitor is two hops from your app, not one:
app.set('trust proxy', 2);With the common trust proxy: 1, req.ip is Railway’s edge, and every visitor looks like the same few addresses. That hides who is scraping you and makes any per-IP rule useless. Railway also sets X-Real-IP to the client address, if you prefer to read that through the middleware’s getIP option.
If you put Cloudflare or another proxy in front of Railway, that is one more hop: count it too, or use trustProxy: 'cloudflare'.
Prove it reports
Section titled “Prove it reports”Request any page with the reserved test user agent:
curl -A "WebDecoy-Test/1.0" https://YOUR-APP.up.railway.app/A detection labeled Test appears on the Detections page within a few seconds. Test detections are excluded from stats and billing. If nothing arrives, check the deploy logs: the template logs WEBDECOY_API_KEY is not set at startup when the variable is missing.
Enforce
Section titled “Enforce”When you have seen what it would block, set mode: 'enforce'. Blocked requests then get a 403; pass onBlocked to answer them your own way. See Express middleware.