Getting started
From signing up to your first verified human.
How do I get an API key?
Sign up at /signup, then click the link in the confirmation email. Your live key is waiting on your dashboard the moment you land there. No credit card, and the 14 day trial has full API access from the first minute.
I signed up but never got the confirmation email.
Check spam first, it is the usual culprit. If it is not there, open /verify-pending or your dashboard and press Resend the email. We also re-send it automatically about a day after signup. If it still does not arrive, email team@humaverify.com and I will verify the account by hand.
What does the integration actually look like?
Two pieces. The huma.js snippet on the page you want to protect, which measures behaviour in the browser, and one server side POST to /api/v1/verify at the moment that matters (signup, login, checkout). You get back a confidence score and, on Pro and Enterprise, a separate AI agent verdict. Your code decides what to do with them. Full reference and copy paste examples live in /docs.
Do I have to use the npm SDK?
No. The SDK is a convenience wrapper. Anything that can make an HTTPS POST works, and the docs show the raw request so you can call it from any stack.
What should I do with the score?
That is your call, and it should be. Most teams start by logging it and acting on nothing, then pick a policy once they have seen their own traffic. Every response includes the threshold your verdict was compared against, so you are never guessing which number decided it. If you want to evaluate before you commit, run it in shadow mode: call verify, log the confidence, act on nothing, then look at the signups you already know were fake and see where they landed.
Errors and troubleshooting
Every error the API can return, and what to do about it.
My key is valid but I keep getting 403 EMAIL_NOT_VERIFIED.
The key does not work until the email on the account is confirmed. Click the link in your signup email, or press Resend the email on your dashboard. This is the single most common reason a new integration fails on the first call.
I am getting 402 TRIAL_EXPIRED.
The 14 day trial has ended. Pick a plan from your dashboard and the same key keeps working, no re-integration needed. If you were mid evaluation and ran out of time, email me and I will extend the trial rather than have you rush it.
I am getting 429. Which limit did I hit?
The code tells you which one. MONTHLY_LIMIT_EXCEEDED means you used your plan's monthly verifications; the response includes the reset date and you are never billed an overage. BURST_LIMIT_EXCEEDED means too many requests in one minute, and the response carries a Retry-After header. USER_FLOOD_DETECTED means one of your own userId values is being verified far more than a real person would be, which usually means a loop in your code or an attack on one account.
I am getting 401.
MISSING_AUTH means no Authorization header reached us. INVALID_API_KEY_FORMAT means the header arrived but the key is not shaped like one, which is almost always a stray quote, a newline, or a missing Bearer prefix. INVALID_API_KEY means the key is well formed but does not match an account, so check you are not using a key from a different project.
I am getting 503.
Something on our side could not answer safely, so we declined rather than guess. Retry, and if it persists tell me. Design your call so a failure lets the request through: wrap it in a timeout and a catch. An outage on our side should never block your real users, and that part lives in your code, not ours.
Every score comes back low, even for real people.
Almost always the snippet is not loading or its output is not reaching your server, so verify receives nothing to score. Confirm huma.js is on the page in question, and confirm the session payload is actually in the body of your server side call. If it is genuinely reaching us and the scores still look wrong for your traffic, send me an example and I will look at it directly.
Do you have a status page?
Not yet, and I would rather say that than point you at a page with twelve days of history on it. If something looks broken, email team@humaverify.com and you will get a real answer from the person who wrote the endpoint.
Plans and billing
What things cost and what happens at the edges.
What happens when I hit my monthly limit?
The API returns 429 with the reset date and verification stops until the window resets. We do not bill overages, so you can never get a surprise invoice. The tradeoff is real and worth planning for: handle that 429 the same way you would handle us being unreachable, and let the request through.
Can I change plans later?
Yes, from your dashboard. Upgrades take effect immediately. Downgrades apply at the start of the next billing cycle.
Is there a free plan?
There is a 14 day free trial with full API access and no credit card. There is no perpetually free tier. If your signups are not worth the price of the smallest plan, do not buy this, build it. A honeypot field and a rate limit will get you a long way and I will happily tell you how.
What counts as a verification?
One POST to /api/v1/verify, whatever the result. Requests rejected for a bad key or a rate limit are not counted. If you use session monitoring, a heartbeat only records a verification when it actually flags an anomaly, so a quiet session costs you nothing.
How do I cancel?
From the billing portal on your dashboard, or email team@humaverify.com and I will do it. No retention call, no form to fill in, and nothing that requires you to explain yourself.
Privacy and data
What leaves the browser, and what we keep.
Is this a tracker? Are you fingerprinting my users?
No. The snippet sets no cookies, writes nothing to local storage, and does no device fingerprinting: no canvas, no WebGL, no user agent profiling. It creates no identifier that follows a person from your site to any other site. You can confirm all of that in devtools, and I would rather you did than take my word for it.
What actually leaves the browser?
Summary statistics only. Pointer coordinates and the content of anything typed are reduced to timings, counts and variability measures inside the browser itself, and the original traces are discarded there. Only those summary numbers reach our servers. The full detail is on the privacy page.
What do you store, and for how long?
The result, the confidence score, those summary numbers, and the user ID you send us, tied to your API key, for 12 months. That user ID is whatever identifier you choose to pass, so send a pseudonymous one. We never ask for or store your end users' names, emails or addresses.
Are you GDPR compliant? Do you have SOC 2?
There is no SOC 2 report, and I will not imply otherwise. On GDPR the honest answer is that the design does the heavy lifting: no PII from your end users, no cross site identifier, no data sold, named subprocessors, and deletion on request. If your legal team needs specific answers or a DPA, email me and I will work through it with you rather than send you a badge.
What it does and does not do
The honest shape of the product.
Will this stop every bot?
No, and anyone who tells you otherwise is selling you something. There is a whole page on where this does not help, where no signal exists, and where it stops on purpose. Read it before you pay, not after.
What is your accuracy? What is your false positive rate?
I do not publish one, because I do not have a benchmark I would defend in public, and at my current volume any number I printed would be invented. When I have one, I will publish the method next to the number so you can argue with both. In the meantime, measure it on your own traffic in shadow mode.
Why will you not tell me how the detection works?
Because the people I am detecting read this site too, and a published weight is a configuration change for whoever is trying to get past it. Everything that affects your decision is public. The recipe is not. There is a page laying out exactly what is on each side of that line and why.
Why not just use Cloudflare Turnstile?
If your problem is volume abuse at the edge, scraping or credential stuffing, use Turnstile. It is free, it runs at the network edge, and I am not going to beat network level defence from an API call. That is a real recommendation. The different question is whether one specific signup is a human, and whether it is an AI agent, which is what I answer.
Who else is using it?
This is early. My other product runs it in production and blocks AI agents at signup, and that is a real integration but not an independent reference, so weigh it accordingly. I will not name customers, even when it would help me, because telling the internet who runs bot detection tells attackers where to test.