Verify humans from your platform

Add human verification to your site in minutes. No API keys, no cost.

Popup SDK Recommended

A popup handles the entire verification flow. Your user verifies with biometrics, and you get the result via a promise.

Frontend

<script src="https://human-pass.org/sdk.js"></script>

<button onclick="verifyHuman()">Verify I'm human</button>

<script>
async function verifyHuman() {
  try {
    // Pass the user's username to bind the verification to them
    const result = await Humanpass.verify({ label: currentUser.username });
    // result = { verified, shortCode, createdAt }
    // Send shortCode to your backend for validation
    await fetch('/your-api/verify', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ code: result.shortCode })
    });
  } catch (err) {
    // User closed the popup without verifying
  }
}
</script>

Options

Backend validation

// In your backend route handler:
const { code } = req.body;
const username = req.user.username; // the logged-in user

const res = await fetch(
  `https://human-pass.org/api/v1/verify/${code}?label=${username}`
);
const data = await res.json();

if (data.verified) {
  // Human verified AND label matches this user
} else if (data.labelMismatch) {
  // Someone tried to use another user's verification
}

Manual flow Alternative

If you prefer not to use the SDK, users can verify on humanpass directly and paste their code into your platform.

API endpoint

Public endpoint. No authentication required. CORS enabled for all origins.

Query parameters

Successful verification

{
  "verified": true,
  "shortCode": "20260223-1432-rSBp",
  "createdAt": "2026-02-23T14:32:44.565Z",
  "label": "u/jordi-zaragoza"  // only if label was passed via SDK or app
}

Invalid or expired code

{
  "verified": false
}

Label mismatch

{
  "verified": false,
  "labelMismatch": true
}

Examples

Basic verification (Node.js):

const code = /* code submitted by the user */;

const res = await fetch(
  `https://human-pass.org/api/v1/verify/${code}`
);
const data = await res.json();

if (data.verified) {
  // Check the code is recent (links expire after 1 min)
  const age = Date.now() - new Date(data.createdAt).getTime();
  if (age < 120_000) {
    // Human verified
  }
}

Verify with username (prevents link reuse by another user):

const code = /* code submitted by the user */;
const username = /* the user's username on your platform */;

const res = await fetch(
  `https://human-pass.org/api/v1/verify/${code}?label=${username}`
);
const data = await res.json();

if (data.verified) {
  // Human verified AND the label matches this user
} else if (data.labelMismatch) {
  // Valid code but generated for a different user
}

With cURL:

# Basic
curl https://human-pass.org/api/v1/verify/20260223-1432-rSBp

# With label check
curl "https://human-pass.org/api/v1/verify/20260223-1432-rSBp?label=u/jordi-zaragoza"