★ 5arz / developers
Proof-of-Human Verification API

Build with 5arz.

Verify a real human performed an action — a watch, a sign-up, a visit — and get a signed credential your app and your advertisers can verify. Three steps, one API call per event. Drop it into any app or dashboard.

Get an API key → Use the SDK

1·2·3Quickstart

Sign up, buy credits, verify. Auth is a single Bearer key; verifications are prepaid.

# 1) Sign up → get your API key (shown once)
curl -X POST https://api.5arz.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name":"Your Company","contactEmail":"you@company.com"}'

# 2) Buy credits → open the returned Stripe checkout
curl -X POST https://api.5arz.com/api/agents/credits/buy \
  -H "Authorization: Bearer arz_live_…" -d '{"pack":"starter"}'

# 3) Verify an event → a signed credential (1 credit)
curl -X POST https://api.5arz.com/api/agents/verify \
  -H "Authorization: Bearer arz_live_…" -d '{"sessionId":"…"}'
# → { "pohf_jwt": "eyJ…", "verified": true }

Get your API key

Self-serve, instant. Your key is shown once — store it. Start in Test mode: a free arz_test_ key with unlimited, uncharged verifications so you can integrate end-to-end before paying. Test credentials are signed but carry test:true — never treat them as production proof.

The SDK zero dependencies

A thin JavaScript client for browsers and Node 18+. Import it directly, or copy the file into your project.

// import directly (browser ESM or bundler)
import { Sarz } from "https://5arz.com/sdk/sarz.js";

const sarz = new Sarz({ apiKey: "arz_live_…" });
const { pohf_jwt } = await sarz.verify(sessionId);        // 1 credit → signed credential

// physical presence (receipt / on-site)
const photoHash = await Sarz.hashPhoto(file);
const { lat, lng } = await Sarz.captureGeo();
await sarz.submitPhysical({ memberId, source:"receipt", lat, lng, photoHash });

// your advertisers verify it themselves — no key needed
const { valid, payload } = await Sarz.verifyCredential(pohf_jwt);

Hosted at 5arz.com/sdk/sarz.js · npm i @5arz/sdk coming soon.

API reference

Base URL https://api.5arz.com. Auth: Authorization: Bearer <apiKey> (all but register + jwks).

POST/api/agents/register
Sign up. Body { name, contactEmail, mode? } — pass mode:"test" for a free arz_test_ sandbox key. → { apiKey, agentId, mode }. No auth. Key shown once.
POST/api/agents/credits/buy
Buy a pack { pack: "starter" | "growth" | "scale" } → { checkoutUrl } (Stripe). Credits post on payment. Test keys skip this — unlimited free.
GET/api/agents/credits/balance
Remaining verifications → { balance, lifetimePurchased, lifetimeConsumed, packs }.
POST/api/agents/verify
Attest a verified human session. Body { sessionId } → signed PoHF credential (1 credit). 402 if no credits.
POST/api/agents/verify-personhood
Prove a real, unique, live human. Body { memberId } → signed Proof-of-Personhood credential (1 credit).
POST/api/kinetic/submit
Physical presence. Body { memberId, source:"receipt"|"geo_photo", lat, lng, photoHash } → scored session, mint a credential via /api/agents/verify. One-time-use per photo.
GET/.well-known/jwks.json
Public keys. Anyone validates a 5arz credential's ES256 signature against these — no 5arz software.

Verify a credential (the buyer side)

Every 5arz credential is an ES256 JWT. Your advertisers/partners verify it themselves with any standard JWT library, or our SDK:

import { Sarz } from "https://5arz.com/sdk/sarz.js";
const { valid, payload } = await Sarz.verifyCredential(pohf_jwt);
// valid === signature OK + iss is 5arz + not expired

Prefer no code? Paste any credential into the in-browser verifier.

Auth, credits & errors