For Developers

// In the APTOGON console (/console): create a key, then verify your domain.
// pk_live_…  — publishable key, safe to ship in the browser
// sk_live_…  — secret key, server-side only (shown once at creation)

<!-- Declarative: renders a "Verify you're human" button -->
<script src="https://homosapience.org/embed/v1/aptogon.js"
        data-aptogon-key="pk_live_…"></script>
<div data-aptogon-verify data-on-success="onHuman"></div>

<script>
  // …or call it programmatically (opens the APTOGON signer popup):
  async function verify() {
    const { token, trust_band } = await window.Aptogon.verify({
      publishableKey: 'pk_live_…',
    })
    // send `token` to your backend to confirm it
    await fetch('/my/confirm', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ token }),
    })
  }
</script>

// On YOUR server — never expose sk_live_ to the browser
const res = await fetch('https://homosapience.org/api/embed/verify', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer sk_live_…',
  },
  body: JSON.stringify({ token }),
})
const { human, did_hash, trust_band } = await res.json()
if (human) {
  // verified, unique human — trust_band ∈ newcomer | community | trusted
  // did_hash is anonymous (no link to the user's real identity)
}

# 1. Create challenge (server-side)
curl -X POST https://homosapience.org/api/embed/challenge \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{"domain":"yourplatform.com","session_id":"sess_abc123"}'

# 2. After widget completes, redeem token (server-side)
curl -X POST https://homosapience.org/api/embed/verify \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{"token":"tok_9f3b1d7c..."}'

import requests

BASE = "https://homosapience.org/api"
SK = "sk_live_…"
HEADERS = {"Authorization": f"Bearer {SK}", "Content-Type": "application/json"}

def create_challenge(domain: str, session_id: str) -> dict:
    r = requests.post(f"{BASE}/embed/challenge", headers=HEADERS,
                      json={"domain": domain, "session_id": session_id})
    r.raise_for_status()
    return r.json()

def verify_token(token: str) -> dict:
    r = requests.post(f"{BASE}/embed/verify", headers=HEADERS,
                      json={"token": token})
    r.raise_for_status()
    return r.json()

# After widget completes and sends token to your backend:
result = verify_token("tok_9f3b1d7c...")
if result["human"] and result["trust_band"] in ("community", "trusted"):
    print("Access granted")

const BASE = 'https://homosapience.org/api'
const SK = 'sk_live_…'
const h = { Authorization: `Bearer ${SK}`, 'Content-Type': 'application/json' }

async function createChallenge(domain, sessionId) {
  const r = await fetch(`${BASE}/embed/challenge`, {
    method: 'POST', headers: h,
    body: JSON.stringify({ domain, session_id: sessionId }),
  })
  if (!r.ok) throw new Error(await r.text())
  return r.json()
}

async function verifyToken(token) {
  const r = await fetch(`${BASE}/embed/verify`, {
    method: 'POST', headers: h,
    body: JSON.stringify({ token }),
  })
  if (!r.ok) throw new Error(await r.text())
  return r.json()
}

// In your route handler (e.g. Express):
app.post('/confirm', async (req, res) => {
  const { human, did_hash, trust_band } = await verifyToken(req.body.token)
  if (!human) return res.status(403).json({ error: 'not_human' })
  // trust_band ∈ newcomer | community | trusted
  res.json({ ok: true, did_hash, trust_band })
})