User-Agent and forwards it to Profound. For the public pages you have opted in, Profound returns a published, pre-rendered copy of the page when one exists. For everything else it passes your origin’s live response straight through. Human visitors, search crawlers, API calls, and assets never leave your existing route.
Dynamic Bot Rendering is served by Profound’s Concierge service, so its request and response headers use the prefix
x-concierge-.How a request flows
1
Your CDN classifies the request
Your routing rule matches the
User-Agent against the supported assistant list. Only matching requests go to Profound. The Cloudflare and CloudFront examples also restrict routing to a path allowlist; the Vercel rule forwards all assistant traffic and lets your Profound policy decide.2
Your CDN forwards the request to Profound
The rule attaches your API key, your public host, and the original path and query as trusted headers. It sets those values from its own configuration and the parsed request, never from headers a client sent. Profound ignores client-supplied
x-concierge-* identity headers.3
Profound serves a published render, or falls back to your origin
Profound checks the API key, confirms the host is registered to your organization, and resolves the policy for the path. If the path has a published render and policy allows serving, Profound returns that render. Otherwise it fetches the page from your origin and returns the live response unchanged. Depending on policy, that miss can also schedule a background render of the page as a new candidate.
4
The assistant receives your page
A published render is fully rendered HTML: the same page a browser produces after JavaScript runs. Rendering makes your content readable to the assistant. It does not guarantee inclusion or citation in an answer.
Supported AI assistants
Profound identifies the assistant from the originalUser-Agent on every request, using the same tokens your CDN rule matches on. Matching is a case-insensitive substring test.
Search crawler routing
Ordinary Googlebot and Bingbot requests fall outside the list above and stay on your existing route. Test your site’s cache and edge rules to confirm this before rollout. Dynamic Bot Rendering doesn’t cloak: the rendered page is the same page a browser produces after JavaScript runs.How rendering and serving are controlled
Two independent settings decide what an assistant gets for a given URL:- Policy answers “may Profound serve stored content for this path, and to which assistants?”
- Publication answers “which exact render is live for this path?”
off policy serves nothing. A serve policy on a path with no publication falls back to your origin. You manage both yourself in the Profound dashboard.
Policy modes
off is the default for any path no rule covers. A newly registered domain does nothing until a rule opts a path in, so onboarding is inert until you decide what to render. Use warm to build up candidates for review before you start serving. serve never publishes anything by itself; it only permits an existing publication to be delivered.
Rules and precedence
Every rule belongs to one registered domain. A domain default sets the baseline for the whole host, and page rules override it for specific paths. A page rule matches an exact path (optionally pinned to a query string), a path prefix, or a glob such as/blog/*. Prefix and glob rules match on the path without its query string.
For each request Profound picks one winning rule:
- An exact rule for the path and query string.
- Otherwise, an exact rule for the path.
- Otherwise, the best matching prefix or glob rule. Higher priority wins, then the more specific pattern.
- Otherwise, the domain default.
- With no rule at all, the effective mode is
off.
serve, a /docs/* rule set to warm, and an exact /docs/start rule that only changes its allowed assistants, /docs/start resolves to serve. The /docs/* rule does not contribute.
A rule can also be deactivated. An inactive rule is skipped entirely, so the domain default or another matching rule takes over for that path. Deactivating an off rule that excluded a path can therefore turn serving back on. To keep a path on your origin, use an active rule with mode off.
Per-rule settings
Each rule can set any of these and inherit the rest:- Mode.
off,warm, orserve, as above. - Allowed assistants. Restrict which supported assistants receive treatment on the matched paths. Unset inherits the domain’s list, and when nothing sets a list every supported assistant is eligible. A list replaces the inherited list rather than intersecting with it, and an empty list excludes every assistant. An excluded assistant receives your origin’s response with an effective policy of
off. The published render itself is shared: you cannot publish different versions for different assistants. - Automatic rendering. Allow or block background candidate renders independently of mode.
servewith automatic rendering off serves only what you publish by hand.offnever renders automatically, whatever this setting says.
Pausing a domain
Pausing a domain sends every assistant request for that host to your origin while keeping the registration, rules, renders, and publications intact. Resuming restores the saved behavior. Use pause when you want to stop serving quickly without touching your CDN or your rules. While paused, you can still render, review, and publish pages.From render to live page
Every render starts as a candidate: a stored snapshot of one URL, made either in the background by an eligible request or on demand. A URL can accumulate several candidates. None of them is served until you publish one.1
Review
A candidate that differs sharply from the page currently published for that URL is held as pending. That happens when its visible text collapses to a fraction of the live page’s, or when both the title and the first heading change. Preview the candidate, then approve or reject it. Approval marks it eligible for publication and nothing more. When a URL has no published page yet, there is nothing to diverge from and the candidate is stored as approved.
2
Publish
Publishing selects one exact render as the live page for that URL. Publishing a pending candidate approves it in the same step. A rejected candidate cannot be published.
3
Roll back, unpublish, or replace
Rolling back is publishing an earlier render for the same URL. Unpublishing removes the live page so assistants return to your origin, and keeps the render history. Rejecting a page that is currently published also unpublishes it. To refresh content, render a new candidate, review it, and publish it.
/pricing does not publish /pricing?plan=pro, and each variant is rendered, reviewed, and published on its own.
Fail-open by design
Fail-open happens at two layers, and neither covers every failure on its own.CDN-level failover
The Cloudflare Worker retries your origin for fetch failures, a response-header deadline, and a configured list of statuses. CloudFront uses an origin group with configured failure criteria and timeouts. Vercel’s routing rule has no CDN-level failover.
Service-level fail-open
Once a request is authenticated and valid, Profound fetches your origin whenever it cannot serve a stored render: no publication, policy set to
off or warm, an unknown assistant, an unreadable render, or an internal lookup failure. Your origin must still be reachable.x-concierge-* response headers, as described in Verify and troubleshoot.
Scope and limits
GETonly. Other methods, includingHEAD, are not part of the contract. Usecurl -sD - -o /dev/null, notcurl -I, when testing.- Public, non-personalized pages only. Opt in only reviewed public pages, whether through your policy rules in Profound or through a path allowlist in your CDN rule. An extensionless path is not proof of a page: keep APIs, GraphQL, authentication, administration, framework resources, and session-sensitive routes out. The Cloudflare and CloudFront examples allow only
/,/pricing,/docs, and/docs/getting-started; replace these with your own paths. - Query strings are part of the page identity.
/products?id=aand/products?id=bare distinct pages, stored and rendered separately. - One host per rule. The public host your rule sends must match a domain registered in Profound. Serve several hosts with one rule per host.
- No credentials reach your origin through Profound. Profound does not forward viewer cookies or authorization headers when it fetches your origin, and the example rules keep credential-bearing requests on your existing route. Protected pages may render as a login page or public content, which is a compatibility boundary rather than a leak.
- One render per URL, not per visitor. A stored render is not varied by session, language, geography, or other request headers. If the same URL serves different content by those signals, preview the render and confirm that one version is acceptable for every assistant before adding it to your allowlist.
Before you start
Complete these steps in the Profound dashboard before configuring your CDN. The Dynamic Bot Rendering endpoint your CDN will call ishttps://concierge.tryprofound.com.
Also record your existing CDN routes, functions, cache policies, and rollback settings before you change anything, and check that web application firewall (WAF) rules, bot challenges, deployment protection, and origin allowlists let both assistant requests and Profound’s origin fetches through. If your origin needs a way to identify Profound’s fetches, contact Profound support.
1
Register your domain
Open Dynamic Bot Rendering in the Profound dashboard and add the exact public host you serve, such as
www.example.com. The host must resolve publicly and answer over HTTPS. Register the host visitors reach: if your apex domain redirects to www, register the www host rather than the apex, and never an internal origin hostname. The hostname is fixed once registered.2
Create an API key
Create a Dynamic Bot Rendering API key and copy it. The raw value is shown once, so store it in your CDN’s secret store immediately.One key covers every domain registered to your organization, including domains you add later, so most customers need only one. Create additional keys when you want to rotate without downtime, or to manage rotation and revocation separately across properties. Additional keys are still organization-wide, not restricted to one property.
3
Set a policy and publish a test page
Give the domain a policy that opts at least one public page in with mode
serve, render a candidate for that page, review it, and publish it. Keep the published URL and its expected HTML for verification.After configuring your CDN, an assistant request for that URL should return x-concierge-cache: HIT and the rendered HTML. Repeated requests never substitute for publication: a MISS stays a MISS until a render is published.Choose your CDN
Cloudflare
One Worker on your zone.
Amazon CloudFront
One CloudFront Function, without Lambda@Edge.
Vercel
One routing rule in
vercel.json.GET. Contact Profound support and we’ll help you map it.