Skip to main content
Auto Capture is in a closed beta and isn’t available to every workspace yet. We’d love your feedback: email support@tella.com.
Every Auto Capture in your workspace sends a unique header to the site it captures. Configure your firewall or bot protection to allow requests containing that header, and captures of your own site won’t be blocked or rate-limited.

​
Find your header

  1. Click your workspace name in the top-left corner and choose Settings.
  2. Click Credentials, under Other in the settings sidebar.
  3. Under Capture identification, copy the Header name (X-Tella-Auto-Capture) and the Header value.
Every member of the workspace sees the same value. There’s nothing to turn on.
Don’t share the header value publicly: anyone who has it can get past the firewall rules you set up with it.

​
Which requests carry the header?

HTTPS requests to the site the capture was started on and its subdomains. A capture of www.example.com sends it to example.com, app.example.com and so on. Requests to any other site never carry it, including third-party scripts, CDNs and a site your page redirects to.

​
Allow captures in Cloudflare

  1. In the Cloudflare dashboard, open your domain and go to Security → WAF → Custom rules, and click Create rule.
  2. Click Edit expression and enter, with your header value in place of VALUE:
  3. Under Then take action, choose Skip, and select the protections that block captures, such as All remaining custom rules, Super Bot Fight Mode Rules and Rate limiting rules.
  4. Click Deploy.
Cloudflare’s free Bot Fight Mode can’t be skipped by a rule. If it blocks captures, turn it off or move to Super Bot Fight Mode.

​
Allow captures in AWS WAF

Add a rule to your web ACL with a lower priority number than your Bot Control and rate-based rules:
  • Inspect: a single header, x-tella-auto-capture.
  • Match type: exactly matches string, with your header value.
  • Action: Allow.

​
Allow captures in the Vercel Firewall

  1. In your Vercel project, go to Firewall and click Configure, then New Rule.
  2. Set the condition to Request Header X-Tella-Auto-Capture Equals your header value.
  3. Set the action to Bypass, and save and publish the rule.

​
What the header can’t get past

The header lets captures past checks your firewall or network provider makes on each request. It doesn’t solve a CAPTCHA, Cloudflare Turnstile, or another challenge that runs inside your page. If your sign-up or sign-in form shows one, have your app skip it when the request carries the header.
Last modified on October 16, 2026