HumanProof

Prove a person is present before a form or an action goes through, without learning who they are. Add one script to the page and one check on your server.

HumanProof answers one question: is a person here right now? It never answers who. Use it where bots hurt you (sign-up, contact forms, checkout, account recovery) without making real people solve puzzles.

Quickstart

Register your site. In the hub, open HumanProof → Sites and add the host your form lives on, such as www.example.com. HumanProof only vouches for the hosts you register.

Add the script and mark the form. The script finds every element marked data-humanproof; on a form, it adds a humanproof-token field when the person has proved they are present.

<script src="https://id.trustaige.com/humanproof.js" defer></script>

<form action="/signup" method="post" data-humanproof>
  <input name="email" type="email" required>
  <button type="submit">Create account</button>
</form>

Check the token on your server. Send the token and your site’s host to the verify endpoint, and act on valid. Never trust the form without this check: the browser can send anything.

app.post('/signup', async (req, res) => {
  const token = req.body['humanproof-token'];
  const check = await fetch('https://id.trustaige.com/humanproof/verify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ origin: 'www.example.com', token: token || '' }),
  });
  const { valid } = await check.json();
  if (!valid) return res.status(403).send('Prove you are human, then try again.');
  await createAccount(req.body);
});

func handle(w http.ResponseWriter, r *http.Request) {
    token := r.FormValue("humanproof-token")
    body, _ := json.Marshal(map[string]string{"origin": "www.example.com", "token": token})
    resp, err := http.Post("https://id.trustaige.com/humanproof/verify", "application/json", bytes.NewReader(body))
    if err != nil {
        http.Error(w, "try again", http.StatusServiceUnavailable)
        return
    }
    defer resp.Body.Close()
    var v struct{ Valid bool }
    json.NewDecoder(resp.Body).Decode(&v)
    if !v.Valid {
        http.Error(w, "Prove you are human, then try again.", http.StatusForbidden)
        return
    }
    createAccount(w, r)
}

@app.post("/signup")
def handle():
    token = request.form.get("humanproof-token")
    check = requests.post("https://id.trustaige.com/humanproof/verify",
                          json={"origin": "www.example.com", "token": token or ""}, timeout=5)
    if not check.json()["valid"]:
        abort(403, "Prove you are human, then try again.")
    return create_account(request.form)

curl https://id.trustaige.com/humanproof/verify \
  -H 'Content-Type: application/json' \
  -d '{"origin":"www.example.com","token":"<humanproof-token>"}'

The verify response

Field	Meaning
`valid`	`true` when the token is genuine, has not been used before, and meets the policy of a site you registered. The only field you need to act on.
`tier`	How presence was shown, when valid: `prove`, `prove_plus` or `attested`.
`code`	Why the token was refused, when it was. Log it; don’t show it to the person.

Each token is good for one check. The codes you can get back when valid is false:

Code	What happened
`spent`	The token was already checked once. Ask the person to prove presence again.
`origin_not_enabled`	The origin you sent is not a site registered for HumanProof.
`below_site_policy`	Presence was shown, but not as strongly as this site’s policy requires.
`invalid`, `malformed`	The token is not one HumanProof issued.
`bad_request`	The request was missing `origin` or `token`.

The full request and response, with every error, are in the API reference.