A risk score guesses. We return a signature.
Most bot-detection APIs return a number — how much traffic looks automated. 5arz answers a narrower question: was a real, ID-verified, live human present for this session?
The answer is an ES256 credential. It validates against a public key or it doesn’t, and anyone can check it without asking us.
AI-generated image
Two different questions.
Edge bot mitigation should keep doing the job it’s good at. It just can’t produce the artifact below.
| Aspect | Scoring / bot detection API | 5arz human verification API |
|---|---|---|
| Question asked | Does this traffic look automated? | Was a real human present? |
| Shape of answer | A probability you set a threshold against | A signed credential that validates or fails |
| Who can check it | You, by calling the vendor | Anyone, offline, against a public JWKS |
| If the vendor is offline | You are blind | Already-issued credentials still verify for their validity window |
| Passes to a third party | Not portably — the score is yours | Yes — the credential travels with the claim |
| Failure direction | False positives on unusual real humans | Absence of proof, which is itself readable |
A scoring system must answer every request, even ones it can’t judge. An attestation layer may say nothing — and “no credential was issued” is a cleaner input than a confident-looking 0.5.
One call to issue. One local check.
The third step needs no network call to us after the first key fetch.
- No card, no sales call — an agent can register itself
- Fetch the JWKS once and cache it; re-fetch on key rotation
- No round trip, no rate limit, no dependency on our uptime
# 1 · Register — no card, no sales call. An agent can do this itself. curl -X POST https://api.5arz.com/api/agents/register \ -H 'Content-Type: application/json' \ -d '{"name":"Acme","contactEmail":"dev@acme.com","mode":"test"}' # → { "apiKey": "arz_test_…" } test-key credentials are marked test:true # 2 · Verify a human — returns a signed PoHF credential (an ES256 JWT) curl -X POST https://api.5arz.com/api/agents/verify \ -H "Authorization: Bearer $ARZ_KEY" \ -H 'Content-Type: application/json' \ -H 'Idempotency-Key: 7f3a…' \ -d '{"sessionId":"sess_…"}' # → { "ok": true, "attestationId": "…", "pohf_jwt": "eyJhbGciOiJFUzI1NiIs…", # "jwks_url": "https://api.5arz.com/.well-known/jwks.json", # "verify_hint": "Import the ES256 JWK from jwks_url, validate pohf_jwt…", # "creditsRemaining": … } # 3 · Anyone verifies it — offline, any language, any JWT library # Public keys: https://api.5arz.com/.well-known/jwks.json
Your agent can integrate without you.
5arz is listed in the official Model Context Protocol registry. An agent can discover the server, register itself, verify a human and check the credential — no dashboard.
register_agent
Create an API key. Pass mode:"test" for a free sandbox key — 1,000 verifications a day, 10,000 a month.
verify_human
Mint a signed PoHF credential for a verified session, or attest personhood.
check_credential
Validate a credential against the live JWKS. No API key required — pure verification.
get_vhh_index
Read the published Verified Human Hour index.
get_balance
Check seals remaining this month on the key.
+ plan management
Endpoint: https://mcp.5arz.com (Streamable HTTP). Live tool list and client config at 5arz.com/mcp.
Where teams put it.
Signup and account creation
Attach a portable human attestation when an account is created. Downstream systems inherit proof instead of re-deriving suspicion.
Agent-initiated actions
When an AI agent acts for someone, record whether a real person was present for the action — not just at enrollment.
Human-in-the-loop steps
Pipelines that need a human judgment call can prove the step happened — signed, and checkable by an auditor.
Content provenance
Attest that a person, not a model, produced or approved a piece of work. A reviewer can validate it independently.
Personhood groundwork
Attest an identity-verified person was present, without sharing identity attributes — optionally wallet-bound. Cross-account uniqueness is not asserted.
Disclosure and audit trails
Keep a verifiable record of human involvement, for regimes that expect you to show whether a person was in the loop.
What we do not collect.
The credential is deliberately thin. It attests that a person was present for a specific action — not who they are.
- ID and liveness checks are done by our verification partners, Stripe Identity and Didit
- 5arz never receives the selfie or ID image — only a signed result
- No biometric templates stored by 5arz
- A relying party gets proof a real human was present — never identity documents, history or a score
A verification layer that quietly builds identity dossiers becomes a liability to everyone who integrates it, including us.
Questions.
What does a human verification API actually return?
Most return a risk score — a probability that traffic looks automated. 5arz returns an ES256 JWT: a signed statement that a real human was present for a specific verified session. The signature either validates against the public key or it does not.
How do I verify a credential without calling 5arz?
Fetch the public keys once from https://api.5arz.com/.well-known/jwks.json, cache them, and verify with any JWT library in any language. After the initial key fetch the check is local. Re-fetch on key rotation.
How do I get an API key?
POST to https://api.5arz.com/api/agents/register with a name and contact email, or call register_agent on the MCP server at https://mcp.5arz.com. No sales call and no card. An AI agent can complete registration on its own.
Is there a sandbox?
Yes. Register in test mode for a sandbox key with the prefix arz_test_ with limits of 1,000 verifications a day and 10,000 a month. Credentials issued by a test key are marked test:true and must never be treated as production proof.
What does human verification cost?
Checking a credential is free and needs no account — anyone can validate any 5arz credential offline against our public keys. Verifying a human is free at any volume. Issuing credentials is free up to 1,000 seals a month on the Free plan, with no card and no expiry. Paid plans add the hosted dashboard, webhooks, longer retention and higher seal volume: Starter $99/mo, Growth $499/mo, Scale $2,499/mo. Current terms are on the pricing page.
Is biometric data stored?
No biometric templates are stored by 5arz. ID and liveness checks are done by our verification partners (Stripe Identity and Didit), and 5arz never receives the selfie or ID image — only a signed result.
Does this replace bot detection?
No, and it is not trying to. Edge bot mitigation screens hostile traffic and will keep doing that job. A human attestation answers a different question — whether a real person was present for a specific action — and it is a positive, portable claim rather than a negative inference held by one vendor.
Stop scoring. Start proving.
Two fields, no card, no sales call. Or let your agent register itself through MCP.