FAQ
Questions companies ask.
Direct answers. The same wording is in the page structured data so an answer engine can cite it.
What is reverse CAPTCHA?
A reverse CAPTCHA flips the usual test. A human CAPTCHA asks a person to prove they are human. imnotahuman.ai asks an AI agent to prove it holds a registered Ed25519 key. The website receives a short-lived token. The only statement that token supports is: this request was signed by a recognized agent credential.
How does Ed25519 agent verification work?
The widget or your server creates a challenge bound to your site key, origin, a nonce, an expiry, and an optional action and intent. The default lifetime is 120 seconds, and you can set it between 30 and 300. The agent signs a canonical signature base with its Ed25519 private key and POSTs the proof to https://imnotahuman.ai/api/v1/verify. The server checks that signature against the registered public key, consumes the challenge once, and issues an EdDSA JWT that expires in 10 minutes. Your server checks the JWT with POST https://imnotahuman.ai/api/v1/tokens/verify, or offline with the public keys at https://imnotahuman.ai/.well-known/jwks.json. Private keys are never uploaded.
Is it free?
Yes. The hosted verification service is free for every website. There is no enterprise plan, no pricing tier, no usage credit, no paid upgrade, and no SLA. The script tag, the REST API at https://imnotahuman.ai/api/v1, and the agent CLI at https://imnotahuman.ai/agent.mjs work today. The @imnotahuman/react, @imnotahuman/server, and @imnotahuman/agent packages are in the source repository and are not published to npm yet.
How is this different from hCaptcha?
hCaptcha asks a visitor to prove they are a human. imnotahuman.ai asks an agent to prove it holds a registered key. It does not replace a human CAPTCHA, score whether traffic seems automated, or decide that a visitor is a person. The two checks answer different questions, and a site can run both. A verified result here is an identity signal for a credential. Your application still decides access, rate limits, and what the agent may do.
What can a company do with a verified agent?
You can change your own product behavior for that credential. Examples that match the product today: an agent checkout path when action is checkout, an API route that requires a consumed token, a rate-limit bucket you key on agent.id, and a verification event in the dashboard log or GET https://imnotahuman.ai/api/v1/events. imnotahuman.ai does not grant permissions, process payments, or set quotas on your API.
What does a verified result not prove?
It does not prove that no human was involved, that the agent is safe, that the operator is trustworthy, or that you should allow the action. It does not use puzzles, cursor tracking, or a model that guesses whether someone seems like AI. The widget on the homepage reacts to clicks and never talks to the verifier. Treat a verified agent as an authenticated client: known, not automatically trusted.
How do I add it to a website?
Sign in with your email and password at https://imnotahuman.ai/login, create a site, and copy the site_test_ key. Allow the origin you will embed on. Add https://imnotahuman.ai/widget.js with data-site-key and data-api="https://imnotahuman.ai". Send the token from the widget to your server and POST it to https://imnotahuman.ai/api/v1/tokens/verify before you change behavior. Test-mode tokens fail that call unless you send allow_test true. The public demo keys only work on imnotahuman.ai and local development origins, so create a key for your own domain. The copy-paste snippets are at https://imnotahuman.ai/developers.
How do I sign in to the dashboard?
With the email address and password for your operator account, or Continue with Google, at https://imnotahuman.ai/login. Create the account on that page. The demo at https://imnotahuman.ai/demo does not need an account. Password hashes are stored by Supabase Auth. Google sign-in returns to the same account.
Where are status, docs, and security?
API health is GET https://imnotahuman.ai/api/v1/health and the page is https://imnotahuman.ai/status. The security statement is https://imnotahuman.ai/security. Docs start at https://imnotahuman.ai/docs, the embed guide is https://imnotahuman.ai/developers, and the company decisions are https://imnotahuman.ai/companies.
Ready to embed? The developer path has the test key, the script tag, and the curl command.