HumanPass

HumanPass protects forms and sensitive actions from automated abuse. A browser widget produces a short-lived response token, and your trusted backend verifies that token before continuing the protected operation.

Quick start

Create a site, add the widget, and verify the response on your backend. Integrate HumanPass.

Choose a mode

Use Checkbox, Non-interactive, or Invisible presentation. Compare modes.

Server SDK

Verify responses with the typed @valgix/humanpass server package. Use the SDK.

Security

Keep secrets server-side, bind responses to actions and hostnames, and reject replay. Read the security guide.

What you integrate

HumanPass has two customer-facing parts:

1. Browser widget — loaded from humanpass.valgix.com; receives a public sitekey and creates a one-time response token.
2. Server verification — your backend sends the response token to HumanPass using a secret key, then continues only when success is true.

Browser → HumanPass widget → response token
Browser → Your backend → HumanPass siteverify
Your backend → accept or reject the protected action

Caution

HumanPass is not authentication or authorization. Always keep your existing sign-in, permission, rate-limit, and abuse controls.

Credentials

Credential	Example prefix	Where it belongs
Sitekey	hp_site_live_	Browser and public markup
Secret key	hp_secret_live_	Trusted backend only
Response token	hp_response_	Sent once from browser to your backend

Never place a secret key in HTML, browser JavaScript, a mobile bundle, a public repository, or client-visible environment variables.

Next step

Follow the quick start to protect your first form.