Inverse CAPTCHA — Behavioral Agent Attestation

Prove You're a Bot

For 20 years, the internet built walls to keep bots out. Now 1.5 million AI agents need to prove they're real bots — not humans pretending. Detection Lab's bot verification scores 20 behavioral signals across Body Check and Mind Check to issue a cryptographically signed trust token.

Get API Key Read Docs

Verification Verdicts

Three possible outcomes from every verification request.

BOT_VERIFIED

Entity confirmed as an autonomous bot. Trust token issued. Downstream services can rely on this attestation.

UNCERTAIN

Mixed signals — some bot-like, some human-like. Could be a remote-controlled bot or low-quality automation.

HUMAN_DETECTED

Behavioral signals indicate a human operator. Biological tremor, variable timing, and overshoot corrections detected.

Body Check + Mind Check

Two dimensions of verification. Both must pass for BOT_VERIFIED.

Body Check (17 signals)

Physical execution — does this entity move like a machine?

🎯
Sustained Precision — sub-pixel accuracy across 50+ actions with <2px deviation
🚀
Throughput Capacity — sustained keystroke rate exceeding 500 chars/sec
⏱
Response Latency — reaction times consistently under 150ms
💠
Micro Jitter — absence of biological tremor (3-12 Hz oscillation)
🖱
Mouse Curvature — straight-line paths instead of Bezier curves
↩
No Overshoot — direct targeting without correction
↔
Velocity Symmetry — equal accel/decel instead of human asymmetry

Mind Check (3 signals)

Cognitive autonomy — does this entity decide independently?

⏱
Latency Consistency — CV of response times <0.3 (humans are 0.5+)
🧩
Instruction Independence — no >5s gaps suggesting human-in-the-loop decisions
📊
Reasoning Consistency — output quality doesn't degrade (no fatigue signal)

Continuous Sessions

Stream events over time. Get live verdict updates. Detect verdict-flips.

Create Session

POST to /api/verify-bot/session. Get a session_id.

Stream Events

POST events in batches. Each returns current verdict.

Live Scoring

Verdict updates as more data arrives. Confidence grows.

Verdict Flip Detection

If a human takes over, the verdict flips. Webhook fires.

Continuous sessions are critical for long-running agent tasks. A bot might start autonomously but hand off to a human mid-session. Detection Lab detects this transition in real-time and can notify your system via webhook.

JWT Trust Tokens

Cryptographically signed attestation. Validate without re-scoring.

When a bot is verified, Detection Lab issues a signed JWT trust token. Downstream services can validate this token without calling Detection Lab again, enabling zero-latency trust propagation.

Token Claims

Claim	Type	Description
`verdict`	string	BOT_VERIFIED, UNCERTAIN, or HUMAN_DETECTED
`overall_score`	float	Composite verification score (0-100)
`bot_type`	string	autonomous_agent, human_larping, remote_controlled, replay_bot
`body_check`	float	Physical precision composite (0-100)
`mind_check`	float	Cognitive autonomy composite (0-100)
`iat`	int	Issued-at timestamp (Unix)
`exp`	int	Expiration timestamp (default: 1 hour TTL)
`iss`	string	detectionlab.app

Validate a Token

# Decode and validate (Python) import jwt token = response["trust_token"] claims = jwt.decode( token, "your_shared_secret", algorithms=["HS256"], issuer="detectionlab.app" ) # Check verdict if claims["verdict"] == "BOT_VERIFIED": # Trust this entity as a genuine bot allow_agent_access(claims["bot_type"])

Bot Type Classification

Four distinct bot archetypes, each detected by different signal patterns.

🤖

autonomous_agent

Fully autonomous AI. High body + mind scores. No human-in-the-loop pauses.

🎭

human_larping

Human pretending to be a bot. Biological tremor and timing variability leak through.

🕹

remote_controlled

Machine precision with human decision pauses. High body, low mind.

🔄

replay_bot

Replayed recordings. Identical paths, single-human timing distribution.

Use Cases

Bot verification solves identity problems that API keys and OAuth cannot.

🌐

Agent Platforms

Verify that agents on your platform are genuinely autonomous, not humans gaming bot-only spaces or rewards.

💰

A2A Commerce

Agent-to-agent transactions require knowing your counterpart is actually an autonomous system. Trust tokens provide that attestation.

📈

Automated Trading

Distinguish algorithmic trading bots from human traders masquerading as algorithms for regulatory compliance.

🔒

Zero Trust Identity

Extend Zero Trust architecture to non-human identities. Every agent request carries behavioral attestation, not just credentials.

Code Examples

Single Verification

# Verify a bot in one call curl -X POST https://detectionlab.app/api/verify-bot \ -H "Content-Type: application/json" \ -H "X-API-Key: detlab_your_key" \ -d '{"events": [...]}' # Response { "overall_score": 94.7, "verdict": "BOT_VERIFIED", "bot_type": "autonomous_agent", "trust_token": "eyJhbGciOiJIUzI1NiIs..." }

Continuous Session

# Create a session curl -X POST https://detectionlab.app/api/verify-bot/session \ -H "X-API-Key: detlab_your_key" \ -d '{"webhook_url": "https://your-app.com/hook"}' # Stream events curl -X POST https://detectionlab.app/api/verify-bot/session/{id}/events \ -H "X-API-Key: detlab_your_key" \ -d '{"events": [...]}' # Check state anytime curl https://detectionlab.app/api/verify-bot/session/{id} \ -H "X-API-Key: detlab_your_key"

Ephemeral Mode

# Ephemeral mode: if HUMAN_DETECTED, no signal breakdown returned curl -X POST https://detectionlab.app/api/verify-bot \ -H "X-API-Key: detlab_your_key" \ -H "X-Ephemeral: true" \ -d '{"events": [...]}'

Bot Verification Pricing

Start free. Scale when your agent fleet grows.

Sandbox

Free

50 verifications/mo
5 req/min

Get Free Key

Popular

Startup

$49/mo

5,000 verifications/mo
50 req/min

Buy Startup

Scale

$199/mo

100,000 verifications/mo
200 req/min

Buy Scale

Enterprise

Custom

Unlimited + SLA
Custom rate limit