One script. One GET.

[ keys ]

A public hpv_… site key binds the collector to your allow-listed origins; the matching secret hpv_sk_… reads the verdict server-side. Create your own in the dashboard (sign in, add your origins, copy the keys) — or try hpv_internal on this domain. Base URL https://humanproof.work. The versioned server contract is available as OpenAPI v1.

[ onboarding ]

A new account can complete the full activation path in the dashboard: create an app, register exact origins, store the one-time server secret, install the collector, obtain a proof, configure the webhook endpoint, run one shadow evaluation, accept its signed delivery, and submit an independent outcome. Progress is resumable and diagnostics contain only safe integration facts.

# Use your deployed HumanProof base URL
Content-Security-Policy: script-src 'self' https://humanproof.work; connect-src 'self' https://humanproof.work

# An origin is scheme + host + optional port, with no path or wildcard
https://app.example.com
http://localhost:3000

• invalid_site_key: copy the active public hpv_ key; never use hpv_sk_ in a browser.
• origin_not_allowed: make the dashboard origin exactly match the browser scheme, host, and port.
• Missing coherence: deploy the current /gate.js or current collector package instead of a cached legacy build.
• Webhook signature failures: verify the exact raw body and keep the receiver clock synchronized within five minutes.
• Missing outcomes: submit a closed customer outcome with the original actionId; it never rewrites or retrains the recommendation.

[ server_sdks ]

The TypeScript and Python clients provide typed proof, evaluation, and outcome calls, bounded timeouts and safe retries, explicit outage fallback, idempotency helpers, and exact-body webhook verification. Keep the hpv_sk_… secret on your server.

import { HumanProofClient, createActionId } from "@humanproof/server";

const hp = new HumanProofClient({ secret: process.env.HUMANPROOF_SECRET! });
const result = await hp.evaluate({
  actionId: createActionId(), sessionToken, action: "ai_credits"
});

import os
from humanproof import HumanProofClient, create_action_id

hp = HumanProofClient(os.environ["HUMANPROOF_SECRET"])
result = hp.evaluate({
    "actionId": create_action_id(), "sessionToken": session_token,
    "action": "ai_credits",
})

[ test_mode ]

The repository includes a bounded in-memory simulator with visibly synthetic fixtures for strong human evidence, insufficient evidence, obvious automation, velocity, retry, outage fallback, and signed webhooks. It has no production database path, so its actions never enter reputation, reporting, quota, calibration, or billing. The maintained Next.js 16 reference covers collector token handoff through outcomes and exact-body webhook verification.

[ endpoints ]

<script src="https://humanproof.work/gate.js" data-site-key="hpv_..." async></script>

window.addEventListener("humanproof:token", (event) => {
  sendToYourServer(event.detail.sessionToken);
});

curl "https://humanproof.work/api/verify/standing?sessionToken=hpv_st_..." \
  -H "Authorization: Bearer hpv_sk_..."

# { "score": 91, "tier": "passive", "label": "Likely human",
#   "pass": true, "confidence": "medium", "reasons": ["human_evidence_observed"],
#   "input_authenticity": { "score": 84, "confidence": "high" } }

curl -X POST https://humanproof.work/api/verify \
  -H "Authorization: Bearer hpv_sk_..." \
  -H "Content-Type: application/json" \
  -d '{ "token": "hpv_tok_..." }'

# { "human": { "score": 89, "tier": "passive", "label": "Likely human",
#                "pass": true, "confidence": "medium", "reasons": ["human_evidence_observed"] },
#   "flags": [], "stats": { ... } }

curl -X POST https://humanproof.work/api/abuse/evaluate \
  -H "Authorization: Bearer hpv_sk_..." \
  -H "Content-Type: application/json" \
  -d '{ "actionId": "generation-123", "sessionToken": "hpv_st_...", "action": "ai_credits" }'

# { "decision": "allow", "confidence": "medium", "reasons": [],
#   "policyVersion": "ai_credits-2026-07-22", "mode": "shadow", "proof": { ... } }

curl -X POST https://humanproof.work/api/abuse/outcome \
  -H "Authorization: Bearer hpv_sk_..." \
  -H "Content-Type: application/json" \
  -d '{ "outcomeId": "result-123", "actionId": "generation-123",
        "outcome": "abuse", "occurredAt": "2026-07-22T16:00:00.000Z",
        "confirmedLossUsdMicros": 25000 }'

# { "outcomeId": "result-123", "actionId": "generation-123",
#   "outcome": "abuse", "source": "customer_api", "occurredAt": "...",
#   "receivedAt": "...", "confirmedLossUsdMicros": 25000 }

[ what_is_live ]

Collection, one-shot proof, standing reads, app-scoped reputation, guided self-serve onboarding, idempotent shadow action recommendations, independent outcomes, signed webhooks, OpenAPI, and TypeScript and Python server SDK packages, an isolated synthetic simulator, and a maintained Next.js reference, authenticated application shell, evaluation explorer, self-serve policy controls, and exact source-backed usage with customer caps are implemented. Subscription billing is not available yet. Launch is planned at $499/month for one app and 100,000 evaluated actions.