Ship human verification without the CAPTCHA tax.

1. The endpoint

Every tool lives under /api/tools/{tool}/. Today the only tool is emoji_bot:

2. The API key

Pass your key in the X-API-Key header. Never in a URL, never in client-side code, never in your frontend bundle. Keep it server-side.

X-API-Key: n0d3_tier11_a1b2c3d4…

3. The tool type

The tool is in the URL path. Currently the only tool is emoji_bot — more (e.g. proof_of_work, rate_guard, headless_check) will appear here with no change to the auth model.

Making a request — challenge

curl -X POST https://n0d3.pages.dev/api/tools/emoji_bot/challenge \
  -H "X-API-Key: n0d3_tier11_a1b2c3…"

Response (200):

{
  "challenge_id": "8f3e2a1b-…",
  "target": "😀",
  "options": ["😀", "😃", "😄", "😁", "😆", "😅"],
  "expires_in": 60,
  "quota": { "used_today": 124, "limit_today": 90000,
             "used_month": 3812, "limit_month": 900000 }
}

Show options to the user, tell them to click target. Any option is valid only if it equals the target. Challenges expire in 60 seconds.

Making a request — verify

curl -X POST https://n0d3.pages.dev/api/tools/emoji_bot/verify \
  -H "X-API-Key: n0d3_tier11_a1b2c3…" \
  -H "Content-Type: application/json" \
  -d '{"challenge_id":"8f3e2a1b-…","clicked":"😀"}'

Response (200, success):

{
  "success": true,
  "session_token": "8f3e2a1b-….1735689600000.hmac_sig_here",
  "expires_in": 300
}

Response (200, failure):

{ "success": false, "error": "wrong_emoji" }

On success, you get a session_token — an HMAC-signed proof that this user solved the challenge. You can trust it or verify it later by calling /api/tools/emoji_bot/check-session.

Errors

• 401 missing_api_key — no X-API-Key header
• 401 invalid_api_key — key not found in our system
• 403 key_inactive — key revoked or suspended
• 403 tool_not_allowed — your plan doesn't include this tool
• 429 daily_limit — you've hit your daily ceiling
• 429 monthly_limit — you've hit your monthly ceiling
• 400 challenge_not_found — expired or unknown challenge_id
• 400 wrong_emoji — the clicked emoji didn't match

Current tools

• emoji_bot — Server-minted emoji challenge + verification. Available now.
• More coming: proof_of_work, headless_check, rate_guard