← Amen Challenge · Demo · Health

Integrator quickstart

5 minutes. Prefer dual-check with reCAPTCHA/Turnstile on sensitive actions.

1. Get keys

Ask the Amen operator for siteKey (public) and secretKey (server-only), plus allowed origins and actions.

2. Browser widget

<div id="amen-captcha"></div>
<script src="https://challenge.amensecurity.ca/widget.js"></script>
<script>
  AmenCaptcha.render('#amen-captcha', {
    siteKey: 'YOUR_SITE_KEY',
    action: 'login',
    onToken(token) { window.__amenToken = token; }
  });
</script>

Or React: copy AmenChallenge from Amen web / Inboxes and set publicBaseUrl="https://challenge.amensecurity.ca".

3. Server verify

curl -sS -X POST 'https://challenge.amensecurity.ca/v1/verify' \
  -H 'Content-Type: application/json' \
  -d '{"secret":"YOUR_SECRET","token":"ac1.…","action":"login"}'

Reject unless success: true. Response may include soft risk / band (log it; don’t hard-ban on review alone).

4. Soft by default

• GATE_MODE=balanced — PoW only after escalation
• GATE_MODE=soft — puzzle + honeypot only
• GATE_MODE=off — kill-switch (auto tokens)
• Honeypot + behavior signals prefer escalate/log over deny

5. SEO

Mount only on forms (login, signup, send). Never gate public GET pages or sitemaps.

OpenAPI

Contract lives in the Amen repo: Amen/captcha/docs/openapi.yaml. Live health: /health.