---
title: "Allowing our agent through Akamai"
source: "https://ottom.io/docs/cdn/akamai"
summary: "On Akamai, our agent is let through by defining it as a custom bot in Bot Manager, in a custom bot category of its own whose action is Allow. The addresses are kept in a client list. Like any Akamai security change, it takes effect only once the new configuration version is activated, on the staging network first and then on production."
---

# Allowing our agent through Akamai

On Akamai, our agent is let through by defining it as a custom bot in Bot Manager, in a custom bot category of its own whose action is Allow. The addresses are kept in a client list. Like any Akamai security change, it takes effect only once the new configuration version is activated, on the staging network first and then on production.

## What to match

- User agent starts with `OttomAgent/`. The full string is `OttomAgent/1.0 (+https://ottom.io/agent)`, with `Mobile` added when a check walks your store at phone size.
- Source address is one of those in https://ottom.io/agent/ips.json, also listed at https://ottom.io/agent#addresses.

Match both, never the user agent alone: anyone can send our user agent, but only we send it from those addresses.

## What you need

- Access to Akamai Control Center with permission to edit and activate the security configuration that covers your storefront.
- The current addresses from https://ottom.io/agent/ips.json.
- Bot Manager, for the narrow rule. With App & API Protector alone, the client list in step 1 is what you have.

## Setting it up

1. **Create a client list of our addresses.** In Control Center, open Client Lists and create an IP list named Ottom agent. Add each address from the file, then activate the list on staging and on production. A client list is activated per network, like a configuration.
2. **Create a new version of the security configuration.** Under Web & Data Center Security, open the security configuration that covers your storefront and create a new version from the one active on production.
3. **Create a custom bot category.** In Bot Manager, add a custom bot category named Ottom. Akamai does not let a custom bot join one of its own categories, so it needs a category of its own.
4. **Define our agent as a custom bot.** In that category, add a custom bot named Ottom agent. Give it a condition on the User-Agent header starting with the value below and, where your version offers it, a condition on the client list from step 1. If it will not take both conditions in one bot, match on the client list.

```
OttomAgent/
```
5. **Set the category action to Allow.** Set the action of the Ottom category to Allow for each security policy that covers your storefront. A new category starts with an action set automatically, so check it rather than assume it.
6. **Activate on staging, then production.** Activate the new version on the staging network, run a scan against a hostname that resolves to Akamai staging if you have one, then activate the same version on production.

## Checking it works

Run a scan of your store from your Ottom dashboard. When the rule works, the report has no bot protection finding and the agent reaches your products. In Bot Manager’s reports, requests with our user agent appear under the Ottom category with the action Allow.

## When a scan is still blocked

### Nothing changed after saving

A saved version does nothing until it is active on production. Check the version number active on production is the one with the Ottom category.

### Rate controls still deny us

Rate controls are separate from Bot Manager. Add the client list from step 1 as an exception to the rate policy that fires.

### You have App & API Protector without Bot Manager

Use the client list from step 1 as an exception in the IP/Geo Firewall. That matches the address alone, so add only the addresses in the file.

## Good to know

- Akamai’s screens differ between contracts and versions, more than most providers’. If a name here does not match yours, the Terraform pages below describe the same objects, and your Akamai account team can point at the screen.

## Akamai documentation

- Bot Manager custom bot categories and custom bots: https://techdocs.akamai.com/terraform/docs/bmgr-rc-custom-defined-bot
- Setting up Bot Manager: https://techdocs.akamai.com/terraform/docs/set-up-botman
- Client lists: https://techdocs.akamai.com/terraform/docs/set-up-client-lists
- App & API Protector: https://techdocs.akamai.com/cloud-security/docs/app-api-protector
- Activating a security configuration: https://techdocs.akamai.com/terraform/v5.6/docs/as-rc-activations

## Questions

### Why a category of its own?

Akamai sets actions per category, and custom bots cannot be added to the categories Akamai defines. A category for us alone means its Allow covers us and nothing else.

The same rule for other providers: https://ottom.io/docs/cdn