Everything you need to
verify humans.

curl -X POST https://humaverify.com/api/v1/verify \
  -H "Authorization: Bearer huma_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": "user_abc123",
    "sessionData": { /* the object from Huma.debug().features */ }
  }'

{
  "human": true,
  "confidence": 0.92,
  "threshold": 0.5,
  "token": "h_verified_Kd3mP8luYMC2Mi1x",
  "pii_stored": false,
  "agent": {                       // Pro & Enterprise
    "is_agent": false,
    "agent_confidence": 0,
    "signals": []
  }
}

// After a successful verify():
const result = await Huma.verify('user_123', 'huma_live_...');

if (result.human) {
  Huma.startSession('user_123', 'huma_live_...', result.token, {
    intervalMs: 30000, // every 30 seconds
    onAnomaly: function(r) {
      if (r.action === 'block') {
        window.location.href = '/logout'; // account takeover detected
      }
    }
  });
}

// Call your own backend, which holds the key and forwards to /api/v1/session.
useEffect(() => {
  const id = setInterval(async () => {
    const r = await fetch("/api/huma/heartbeat", {
      method: "POST",
      body: JSON.stringify({
        userId,
        sessionToken: verifyResult.token,
        sessionData: window.Huma.debug().features,
      }),
    }).then((r) => r.json());

    if (r.action === "block") router.push("/logout");
  }, 30000);
  return () => clearInterval(id);
}, [userId]);

{
  "id": "wh_abc123...",
  "secret": "huma_whsec_abc123...",  // shown once
  "url": "https://yourdomain.com/webhooks/huma",
  "events": ["bot.detected", "human.verified"],
  "active": true
}

Huma-Signature: t=1716840000,v1=abc123def456...

import crypto from 'crypto';

function verifyWebhook(rawBody, signature, secret) {
  const [tPart, vPart] = signature.split(',');
  const timestamp = tPart.replace('t=', '');
  const received  = vPart.replace('v1=', '');

  const payload  = `${timestamp}.${rawBody}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(received)
  );
}

{
  "id": "evt_9Kd3mP8luYMC",
  "event": "bot.detected",
  "created_at": "2026-08-06T21:00:00.000Z",
  "data": {
    "user_id": "user_123",
    "human": false,
    "confidence": 0.18,
    "score": 18,
    "threshold": 0.5,
    "reason": "no_human_signals",
    "token": "h_verified_Kd3mP8luYMC2Mi1x"
  }
}

{
  "challenge_id": "ch_abc123...",
  "type": "click_targets",        // or "pattern"
  "payload": {
    "instruction": "Click the 🎯",
    "targets": [
      { "id": "t0", "x": 20, "y": 25, "label": "🌿" },
      { "id": "t1", "x": 65, "y": 25, "label": "🎯" },
      ...
    ]
  },
  "expires_in_seconds": 300
}

{ "passed": true, "token": "h_challenge_abc..." }

{ "passed": false, "message": "Incorrect answer", "attempts_remaining": 2 }

// After verify() returns borderline confidence.
// Render the challenge yourself: there is no component to import yet.
const ch = await fetch('/api/v1/challenge/create', {
  method: 'POST',
  headers: { Authorization: 'Bearer huma_live_...' },
  body: JSON.stringify({ userId }),
}).then(r => r.json());

// ch = { challenge_id, type, payload }
// Show it, collect the answer, then verify it:
const res = await fetch('/api/v1/challenge/verify', {
  method: 'POST',
  headers: { Authorization: 'Bearer huma_live_...' },
  body: JSON.stringify({ challenge_id: ch.challenge_id, answer }),
}).then(r => r.json());

if (res.passed) continueLogin(res.token);
else router.push('/blocked');