VerifyHuman

Documentation

Pick the surface that matches what you're building. New here? Start with Verification modes to choose how you want to verify — server-side, silent on-page, or with a camera.

Live

Verification modes

The full menu — Server-Side (S2S scoring, no page code), Invisible, Captcha, Standard, and the device-only fallback. What each runs, what the respondent sees, and how to wire it. Read this first.

Live · v1.27.1

SDK

Embed the verify widget — HTML drop-in, React, Next.js, or vanilla TypeScript. Five paths, same engine, all server-integrated.

Live

Survey integrations

Add VerifyHuman to the survey platform you already use — Qualtrics, Forsta, Alchemer, LimeSurvey, Sawtooth, SurveyMonkey, Typeform, Jotform, Cint, Dynata. No-code hosted link on every platform; optional inline snippet on the five custom-JS ones.

Live · v1.27.1

In-app browsers & camera

What happens when a survey opens inside Instagram / Facebook / Telegram and the WebView blocks the camera: automatic cross-device QR recovery, the assurance taxonomy (biometric vs device-only), and the minimum-assurance policy.

Live — connect via OAuth

MCP server

Manage projects, rotate signing keys, mint demo keys, inspect analytics — from Claude Desktop, Claude Code, or any MCP-compatible client. Hosted OAuth, zero install.

Live

Server API

Full REST reference. Server-Side scoring (fraud_gate — one S2S call, no page code) plus widget token verification (single + batch), project provisioning, analytics, sessions, and JWKS.

Live

Webhooks

Event payload contract + retry behavior. PENDING → SUCCEEDED / EXHAUSTED state machine, 5 attempts, terminal-4xx skip, idempotency keys.

Where things live

  • Choose how to verify (server-side vs on-page, silent vs camera) — start with Verification modes.
  • Embed the widget on a public page — start with the SDK guide.
  • Score traffic server-side with no page code (panels / supply) — start with the Server-Side mode in Verification modes, then the Server-Side scoring API (POST /api/v1/lite/score).
  • Verify a token server-side — see the API reference.
  • Provision projects from your backend — two flavors:
    • OAuth/MCP (recommended for new integrations): provision_project_with_key returns site key + api key in one round-trip. See the MCP guide.
    • REST + X-API-Key: POST /projects/provision when you already have at least one project-scoped key. See the API reference.
  • Receive event callbacks — see the webhook contract.
  • Automate admin tasks via an LLM client — the MCP guide.
  • Already a customer? Project-specific snippets with your real site key live on your dashboard, under each project's Integrate tab.

What shipped recently

  • Server-Side scoring (fraud_gate): a zero-JS server-to-server risk API — POST /api/v1/lite/score returns a 0–100 score + allow/review/block from network / device / velocity / duplicate / behavior / history signals, with a closed evidence-event learning loop and per-source calibration. See Verification modes and the Server-Side scoring API.
  • unifiedVerdict on the verify response: one allow/review/block disposition + the assurance tier that produced it, across every mode — surfaced on the SDK mount result (SDK v1.16.2). See the SDK guide.
  • 2026-05-21 · VH-01 Option B: MCP tools create_project and provision_project_with_key — OAuth-authed server-to-server provisioning, returns site key + api key in one call. Canonical for “one VH project per study” integrations.
  • 2026-05-19 · VH-01 Option A: POST /projects/provision — REST equivalent using project-scoped X-API-Key.
  • VH-02: SDK init accepts respondentId and metadata; HTML drop-in via data-respondent-id / data-metadata.
  • VH-04: v2 webhook payload now includes respondent_id, metadata, ISO timestamp.
  • VH-05: POST /token/verify-batch — batch up to 100 tokens per call.
  • VH-08: GET /projects/{id}/analytics with X-API-Key auth — REST equivalent of the dashboard analytics page.
  • HTML drop-in flipped to server-integrated mount (was local- only). Drop-in customers now get real sessions, signed tokens, and webhook fires.
  • SDK default apiEndpoint consolidated and pointed at production.