@arcjet/nuxt

Arcjet helps developers protect their apps in just a few lines of code. Implement rate limiting, bot protection, email verification, and defense against common attacks.

This is the Arcjet SDK for Nuxt.

• GitHub source code (arcjet-nuxt/ in arcjet/arcjet-js)
• npm package (@arcjet/nuxt)

Example

This monorepo contains one example using @arcjet/nuxt:

• examples/nuxt/ — Arcjet + Nuxt

What is this?

This adapter integrates Arcjet and Nuxt. Arcjet helps you secure your Nuxt app.

When should I use this?

You can use this if you are using Nuxt. See our Get started guide for other supported frameworks.

Install

This package is ESM only. Install with npm in Node.js:

npm install @arcjet/nuxt

Use

Add this package to modules and configure arcjet.key in nuxt.config.ts:

export default defineNuxtConfig({
  arcjet: { key: process.env.ARCJET_KEY },
  compatibilityDate: "2025-07-15",
  devtools: { enabled: true },
  modules: ["@arcjet/nuxt"],
});

Then in a route such as server/routes/protected.get.ts do something like:

import arcjet, { shield } from "#arcjet";

const aj = arcjet({
  rules: [
    // Shield protects your app from common attacks.
    // Use `DRY_RUN` instead of `LIVE` to only log.
    shield({ mode: "LIVE" }),
  ],
});

export default defineEventHandler(async (event) => {
  const decision = await aj.protect(event);

  if (decision.isDenied()) {
    throw createError({
      statusCode: 403,
      statusMessage: "Forbidden",
    });
  }

  return "Hello, world!";
});

API

👉 Note: after registering the Nuxt module @arcjet/nuxt in nuxt.config.ts, you must import the below API from #arcjet.

This package exports the identifier createRemoteClient. It also exports all identifiers from arcjet core. The default export is arcjet.

This package exports the TypeScript types ArcjetH3Event, ArcjetNuxt, ArcjetOptions, and RemoteClientOptions. It also exports all types from arcjet core.

ArcjetH3Event

H3 event (TypeScript type).

This is the minimum interface similar to H3Event from h3.

Type

import type { IncomingMessage } from "http";

interface ArcjetH3Event {
  node: ArcjetH3NodeEventContext;
}

interface ArcjetH3NodeEventContext {
  req: IncomingMessage;
}

ArcjetNuxt

Instance of the Nuxt integration of Arcjet (TypeScript type).

Primarily has a protect() method to make a decision about how a request should be handled.

ArcjetNuxt#protect(details, properties?)

Make a decision about how to handle a request.

This will analyze the request locally where possible and otherwise call the Arcjet decision API.

Parameters

• event (ArcjetH3Event, required) — H3 event that Arcjet needs to make a decision
• properties (object, optional) — additional properties required for running rules against a request.

Returns

Promise that resolves to an Arcjet decision indicating Arcjet’s decision about the request (Promise<ArcjetDecision>).

ArcjetNuxt#withRule(rule)

Augment the client with another rule.

Useful for varying rules based on criteria in your handler such as different rate limit for logged in users.

Parameters

• rule (Array<Rule>, required) — rule to add to Arcjet

Returns

Arcjet instance augmented with the given rule (ArcjetNuxt).

ArcjetOptions

Configuration for the Nuxt integration of Arcjet (TypeScript type).

👉 Note: you cannot pass key here but instead have to configure it in nuxt.config.ts.

Fields

• characteristics (Array<string>, default: ["src.ip"]) — characteristics to track a user by; can also be passed to rules
• client (Client, optional) — client used to make requests to the Arcjet API; this is configured by adapters (such as @arcjet/nuxt) but can be overwritten for testing purposes
• log (ArcjetLogger, optional) — log interface to emit useful information; this is configured by adapters (such as @arcjet/nuxt) but can be overwritten for testing purposes
• proxies (Array<string>, optional, example: ["100.100.100.100", "100.100.100.0/24"]) — IP addresses and CIDR ranges of trusted load balancers and proxies
• rules (Array<Array<Rule>>, required) — rules to apply when protecting a request

RemoteClientOptions

Configuration for createRemoteClient (TypeScript type).

Fields

• baseUrl (string, optional) — base URI for HTTP requests to Decide API; defaults to the environment variable ARCJET_BASE_URL (if that value is known and allowed) and the standard production API otherwise
• timeout (number, optional) — timeout in milliseconds for the Decide API; defaults to 500 in production and 1000 in development

arcjet

Create a new Nuxt integration of Arcjet.

👉 Tip: build your initial base client with as many rules as possible outside of a request handler; if you need more rules inside handlers later then you can call withRule() on that base client.

Parameters

• options (ArcjetOptions, required) — configuration

Returns

Nuxt integration of Arcjet (ArcjetNuxt).

createRemoteClient

Create a remote client.

Parameters

• options (RemoteClientOptions, optional) — configuration

Returns

Client (Client).

License

Apache License, Version 2.0 © Arcjet Labs, Inc.