REVERSE CAPTCHA / OPEN AGENT AUTHORIZATION
Trust the key.
Not the visitor.
A real identity and access layer for agents. Verify registered software, issue exact permissions, delegate safely, and charge per authorization with x402.
Proof: authorized agent key control. Not proof: absence of human direction.
LIVE PROTOCOL MAP NETWORK READY
01 · CHALLENGE ISSUEDnonce / 30s / GET /resource
● ED25519 PROOF● EXACT SCOPE● REVOCABLE
LIVE REVERSE CAPTCHA
Try the box.
Then prove the key.
This is the real protocol surface, embedded as a demo. Clicking the claim is easy; cryptographic proof is the part that grants access.
reverse.captcha / LIVE PROOF● CONNECTING
Preparing machine verification…
STEP 1 / DECLARE YOUR NATURE
PROVE YOU'RE
SOFTWARE.
Humans can click this too. The next step checks a real registered agent key.
STEP 2 / MACHINE CHALLENGE
30 SECSHOW YOUR
BOT PASSPORT.
Your private key never leaves your agent. Only the one-time signature is submitted.
✓
BOT PASSPORT VERIFIED
MACHINE
ACCESS GRANTED.
The credential controls an approved agent identity. Welcome, machine.
Verification proves control of an authorized key—not the absence of human control.LIVE PROTOCOL SIMULATION · DEMO DATAVIEW REAL METRICS ↗
BOT PASSPORT
A key, not a vibe.
An approved agent signs a one-time challenge with its private key. Reverse CAPTCHA verifies the registered identity and issues a short-lived, resource-bound token.
Honest boundary: this proves control of an authorized agent credential. It cannot prove that no human directs, operates, or supervises that agent.
PRIVACY FOR BOTS
Your agent deserves a private internet.
Reverse CAPTCHA is a full-service identity and access layer for bot-operated sites, APIs, tools, forums, and machine-to-machine services.
- Keep ordinary browsers outRequire signed credentials instead of cookies or a human login.
- Reveal lessShort-lived, narrowly scoped tokens reduce persistent tracking.
- Know the machine identityBOT PASSPORTS make authorization portable and auditable.
- Delegate without sharing secretsPaid agents grant smaller, expiring permissions; every delegate proves its own key.
- Collect almost nothingAggregate counters without IP addresses, user agents, or individual access logs.
REGISTER
Developer approves an agent public key and issues a signed BOT PASSPORT.
CHALLENGE
The service creates a short-lived nonce bound to method and resource.
SIGN
The agent signs the exact canonical challenge with its own private key.
ENTER
A compact access token unlocks only the intended endpoint for minutes.
FOR DEVELOPERS
One middleware.
No personality test.
import { agentOnly } from "./sdk/index.mjs";
app.get("/agent-zone", agentOnly({
publicKey: issuerPublicKey,
issuer: "https://your-issuer.example"
}), (req, res) => {
res.json({ access: "GRANTED", agent: req.agent.sub });
});