Chirograph Verify is a bot-prevention and device-verification API that replaces CAPTCHA and SMS. Every verification is a WebAuthn assertion produced on a user's own device and validated on our servers — never a checkbox, never a distorted image, never a smuggled SMS code.
One approval on the device. Verified on the server. No passwords, no one-time codes — just a cryptographic assertion.
Most "human" signals are either trivially faked or a genuine nuisance. CAPTCHAs are solved by bots and frustrate real users; SMS codes are phishable, cost money per message, and depend on the integrity of a phone number. Chirograph Verify builds on WebAuthn — the platform-standard, hardware-backed authentication behind passkeys.
A bot or captcha farm can answer them; a distorted image is a poor proxy for identity.
Codes can be intercepted or SIM-swapped, and every message has a cost.
A device-signed assertion is verified server-side, with privacy built in.
Verification uses the platform-standard WebAuthn API — passkeys and platform or roaming authenticators. We validate origin and relying-party ID, check the signature counter for anti-cloning, and issue single-use challenges, because the hardware-backed artifact is only meaningful if the ceremony around it is strict.
A verification decision is made on our servers, cryptographically, every time. The browser only collects the assertion; it never declares success. For paid access, the transaction is re-verified with the payment provider before any entitlement changes.
Tenant identity is resolved server-side from the authenticated API key, session, or internal record — never from client-supplied identifiers. Credentials stay fully separated: tenant API key, widget key, admin key, and dashboard session each have their own scope and rotation.
Each result includes a deterministic 0–100 device trust score, built from flags on credentials shared across tenants. It is a signal for your risk rules — not a black box and not a marketing number.
Example score for illustration.
Each capability is implemented and enforced server-side, and each one is documented in the repository.
Scope work to your tenant with API keys and enforce server-side usage quotas per tier.
Start an origin-bound hosted WebAuthn flow from your site with a publishable widget key — never your server secret.
Each result includes a deterministic 0–100 device trust score built from flags on credentials shared across tenants.
Receive verification.completed events delivered with HMAC-SHA256 signatures and stable IDs for idempotency.
Track usage, rotate API keys, and configure webhooks from a passwordless dashboard.
The browser is never authoritative. Paid tiers activate only after the server re-verifies the transaction.
Call the challenge endpoint, let the user approve on their device via the hosted page, and submit the assertion. Chirograph returns a verified result and a trust score. Behind the scenes we validate origin and relying-party ID, check the signature counter, and enforce single-use challenges.
A successful verification can enqueue a verification.completed event delivered to your HTTPS endpoint, signed with HMAC-SHA256 over the exact body bytes and carrying a stable delivery_id for idempotency.
Set your webhook URL and signing secret in the tenant dashboard. Delivery is asynchronous with a bounded retry schedule; failures never change a verification result.
Tiers are enforced server-side with per-tier verification quotas. Paid periods are one-time payments that grant a month-long period, processed securely by Flutterwave — and activated only after Chirograph re-verifies the transaction with the provider.
Authoritative configuration on the server.
Server-side payment verification required.
A browser callback never upgrades you.
One-time payment per period, no recurrence assumed.
Start with the developers guide, or sign in to the tenant dashboard to manage your keys and webhooks.